What is CVE-2025-35050?

CVE-2025-35050 is a critical-severity vulnerability in Newforma Project Center, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2025-10-09.

How severe is CVE-2025-35050?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Newforma Project Center

CVE-2025-35050

Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the '/remoteweb/remote.rem' endpoint, for example using the IIS URL Rewrite Module.

Vulnerability class: Broken Authentication

EPSS: 0.009 (54.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Newforma Project Center — versions 2024.3
Newforma Project_center — versions 2024.3

Weakness classification (CWE)

References

9119a7d8-5eab-497f-8521-727c672e3725 (Product)
9119a7d8-5eab-497f-8521-727c672e3725 (Product)
9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)
9119a7d8-5eab-497f-8521-727c672e3725 (US Government Resource, Third Party Advisory)

Frequently asked questions

What is CVE-2025-35050?: CVE-2025-35050 is a critical-severity vulnerability in Newforma Project Center, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2025-10-09.
How severe is CVE-2025-35050?: Critical severity. CVSS v3 base score is 9.8 out of 10.