CVE-2025-35050

🗓️ 09 Oct 2025 20:19:12Reported by cisa-cgType

cve🔗 web.nvd.nist.gov👁 15 Views🌐 WEB

CVE-2025-35050: Unauthenticated deserialization in Newforma Info Exchange via /remoteweb/remote.rem enables code execution as NetworkService on NPCS.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-35050	9 Jan 202619:04	–	circl
CNNVD	Newforma Project Center Server 安全漏洞	9 Oct 202500:00	–	cnnvd
CNVD	Newforma Project Center Server Code Execution Vulnerability	21 Oct 202500:00	–	cnvd
Cvelist	CVE-2025-35050 Newforma Info Exchange (NIX) .NET unauthenticated deserialization	9 Oct 202520:19	–	cvelist
EUVD	EUVD-2025-33577	9 Oct 202521:31	–	euvd
NVD	CVE-2025-35050	9 Oct 202521:15	–	nvd
OSV	CVE-2025-35050	9 Oct 202521:15	–	osv
Positive Technologies	PT-2025-41466	9 Oct 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-35050	10 Oct 202520:22	–	redhatcve
ICS	Newforma Project Center multiple vulnerabilities	9 Oct 202519:50	–	ics

NVD

Node

newforma project_centerMatch2024.3

[
  {
    "vendor": "Newforma",
    "product": "Project Center",
    "defaultStatus": "unknown",
    "versions": [
      {
        "version": "*",
        "status": "affected"
      },
      {
        "version": "2024.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
cve	www.cve.org/CVERecord
learn	www.learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/using-the-url-rewrite-module
projectcenter	www.projectcenter.help.newforma.com/overviews/info_exchange_overview/
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json

Parameter	Position	Path	Description	CWE
serialized_data	request body	/remoteweb/remote.rem	Endpoint that accepts serialized .NET data leading to remote code execution when exploited by an unauthenticated attacker.	CWE-306, CWE-502

09 Jan 2026 18:19Current

7.6High risk

Vulners AI Score7.6

CVSS 49.3

CVSS 3.19.8

EPSS0.0039

SSVC