Critical severity9.8NVD Advisory· Published Oct 9, 2025· Updated Apr 26, 2026
CVE-2025-35051
CVE-2025-35051
Description
Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:newforma:project_center:2024.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:newforma:project_center:2024.3:*:*:*:*:*:*:*
- (no CPE)
Patches
Vulnerability mechanics
References
3- raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.jsonnvdThird Party Advisory
- www.cve.org/CVERecordnvdThird Party AdvisoryUS Government Resource
- projectcenter.help.newforma.com/overviews/info_exchange_overview/nvdProduct
News mentions
0No linked articles in our index yet.