CVE-2025-35051: Newforma Project Center

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS.

Affected products

• Newforma Project Center: version 2024.3 only

Published 2025-10-09. Last modified 2026-10-08.