CVE-2025-60036

A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running the UA.Testclient.

• CWE-502

• https://psirt.bosch.com/security-advisories/BOSCH-SA-591522.htmlVendor Advisory

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6003The WordPress Single Sign-On (SSO) plugin for WordPress is v…5.3
• CVE-2025-60030Rejected reason: Not used
• CVE-2025-60031Rejected reason: Not used
• CVE-2025-60032Rejected reason: Not used
• CVE-2025-60033Rejected reason: Not used
• CVE-2025-60035A vulnerability has been identified in the OPC.Testclient ut…8.8
• CVE-2025-60037A vulnerability has been identified in Rexroth IndraWorks. T…8.8
• CVE-2025-60038A vulnerability has been identified in Rexroth IndraWorks. T…8.8
• CVE-2025-60039Deserialization of Untrusted Data vulnerability in rascals N…9.8
• CVE-2025-6004Vault and Vault Enterprise’s (“Vault”) user lockout feature …5.3
• CVE-2025-60040Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-60041Authentication Bypass Using an Alternate Path or Channel vul…8.8