CVE-2024-32499 is a code execution flaw in Newforma Project Center Server through version 2023.3.0.32259, where .NET Remoting is exposed. NVD scores it 4.9 medium, though the description says remote code execution. No fixed version is confirmed, so restrict network access and ask Newforma for guidance.
What's affected
Per the NVD record, Newforma Project Center Server through 2023.3.0.32259 is affected because .NET Remoting is exposed.
A public vulnerability list from the research firm Code White shows the product at the latest version, 2023.3.0.32259, with the note not fixed. That is the only status I could confirm. I could not find a fixed release in the sources I read, so ask Newforma directly and do not assume a newer version helps.
The CVSS score of 4.9 is lower than the impact of remote code execution would suggest. The vector requires low privileges and a changed scope. Read the score as a lower bound and judge exposure by who can reach the server.
How to check if you're exposed
Find your Newforma Project Center Server and note the version. Compare it with 2023.3.0.32259.
Then check which networks can reach the server. .NET Remoting uses its own TCP ports, set in the server's configuration. Ask the Newforma administrator which ports the server listens on, and test them from outside the segment where the server lives. On the server itself you can list listening ports:
netstat -ano | findstr LISTENING
Any Remoting port reachable from user networks or the internet needs to be blocked.
What to do now
- Ask Newforma for the fixed version or a documented mitigation, in writing.
- Block access to the server's remoting ports from everything except the hosts that need them.
- Keep the server off the public internet and behind a VPN for remote users.
- Run the service under a low-privileged account and review what it can reach.
- Monitor the server for unexpected child processes and new files.
Why it matters
The class is CWE-94, code injection. .NET Remoting is an older way for .NET programs to call each other across a network. When the endpoint is open to untrusted callers, the data it accepts can lead to the server running code of the caller's choosing.
The practical lesson is about exposure. A project collaboration server often holds drawings and contracts, and it usually sits near the file shares of an engineering or architecture firm. When no patch exists, network segmentation is the control you have, and it works well against this kind of flaw.
Quick check
Why does a 4.9 score go with remote code execution?
The vector requires low privileges, and the score reflects those inputs. The description still says remote code execution, so treat it as serious.
Sources
Last reviewed: 19 October 2026.
