CVE-2025-35050

Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the '/remoteweb/remote.rem' endpoint, for example using the IIS URL Rewrite Module.

• CWE-306
• CWE-502

• https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/using-the-url-rewrite-moduleProduct
• https://projectcenter.help.newforma.com/overviews/info_exchange_overview/Product
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.jsonThird Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2025-35050Third Party Advisory, US Government Resource

Published

Oct 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-35033Medical Informatics Engineering Enterprise Health has a CSV …4.3
• CVE-2025-35034Medical Informatics Engineering Enterprise Health has a refl…6.1
• CVE-2025-35036Hibernate Validator before 6.2.0 and 7.0.0, by default and d…7.3
• CVE-2025-3504The WP Maps WordPress plugin before 4.7.2 does not sanitise…4.8
• CVE-2025-35041Airship AI Acropolis allows unlimited MFA attempts for 15 mi…7.7
• CVE-2025-35042Airship AI Acropolis includes a default administrative accou…9.8
• CVE-2025-35051Newforma Project Center Server (NPCS) accepts serialized .NE…9.8
• CVE-2025-35052Newforma Info Exchange (NIX) uses a hard-coded key to encryp…6.3
• CVE-2025-35053Newforma Info Exchange (NIX) accepts requests to '/UserWeb/C…6.4
• CVE-2025-35054Newforma Info Exchange (NIX) stores credentials used to con…5.3
• CVE-2025-35055Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.…8.8
• CVE-2025-35056Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices…5