PatchTheCVEnewforma vulnerabilities
Recent CVEs affecting newforma products. 14 tracked.
newforma has 14 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 12. Most recent: 2025-10-09. Highest priority: CVE-2025-35050 (score 54/100).
- CVE-2025-35050 CRITICAL 9.8 DOWNGRADE Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a
- CVE-2025-35051 CRITICAL 9.8 DOWNGRADE Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 90
- CVE-2025-35055 HIGH 8.8 UPGRADE Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload a
- CVE-2025-35058 MEDIUM 5.9 UPGRADE Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker t
- CVE-2025-35061 MEDIUM 5.9 UPGRADE Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated
- CVE-2025-35052 MEDIUM 5.3 UPGRADE Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters
- CVE-2025-35053 MEDIUM 6.4 UPGRADE Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'Downloa
- CVE-2025-35062 MEDIUM 5.3 UPGRADE Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an
- CVE-2025-35056 MEDIUM 5.0 UPGRADE Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted fil
- CVE-2025-35057 MEDIUM 5.3 UPGRADE Newforma Info Exchange (NIX) '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker t
- CVE-2025-35060 MEDIUM 5.5 UPGRADE Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated att
- CVE-2025-35054 MEDIUM 5.3 UPGRADE Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma
- CVE-2025-35059 MEDIUM 4.3 UPGRADE Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect vi
- CVE-2024-32499 MEDIUM 4.9 UPGRADE Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is ex
FAQ
How do I fix newforma vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is newforma being exploited right now?
None of the tracked newforma CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which newforma CVE should I patch first?
CVE-2025-35050 currently ranks highest (54/100): Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a.