ZDI-CAN-27996: ZDI-26-108: Bosch Rexroth IndraWorks UA.TestClient XML File Parsing Deserialization Of Untrusted Data Remote Code Execution Vulnerability

Published Feb 19, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bosch Rexroth IndraWorks. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-60036.

Affected Software

1 affected component

Bosch Rexroth Indraworks

Event History

Feb 19, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-27996?

The severity of ZDI-CAN-27996 is rated at 7.8 on the CVSS scale.

How do I fix ZDI-CAN-27996?

To mitigate ZDI-CAN-27996, ensure that all instances of Bosch Rexroth IndraWorks are updated to the latest version provided by the vendor.

What is the impact of ZDI-CAN-27996?

ZDI-CAN-27996 allows remote attackers to execute arbitrary code on affected installations of Bosch Rexroth IndraWorks.

Is user interaction required to exploit ZDI-CAN-27996?

Yes, user interaction is required to exploit ZDI-CAN-27996, as the target must visit a malicious page or open a malicious file.

What should users of Bosch Rexroth IndraWorks do in response to ZDI-CAN-27996?

Users of Bosch Rexroth IndraWorks should prioritize applying any available security updates and patches related to ZDI-CAN-27996.