CVE-2025-35062: Newforma Info Exchange (NIX) default anonymous access

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-09 · updated 2026-10-08
Weakness: CWE-276

Description

Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication.

Affected products

Newforma Project Center: before 2023.1 — fixed in 2023.1

How to fix

Upgrade to a fixed version: Newforma Project Center 2023.1. Check the vendor advisory for mitigations.

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json
https://www.cve.org/CVERecord?id=CVE-2025-35062

Get alerted when CVE-2025-35062 or the next vulnerability affects your stack