Latest N-able N-central vulnerabilities #
N-able has disclosed two vulnerabilities in certain versions of N-central. There is evidence that these vulnerabilities are being actively exploited in the wild.
- A deserialization of untrusted data vulnerability allows a remote, low-privileged adversary to execute arbitrary code on the system. This vulnerability has been designated CVE-2025-8875 and has been rated critical with a CVSS score of 9.4.
- An improper input validation vulnerability allows a remote, low-privileged adversary to execute arbitrary OS commands on the system. This vulnerability has been designated CVE-2025-8876 and has been rated critical with a CVSS score of 9.4.
The following versions are affected
- N-central versions prior to 2025.3.1
What is the impact? #
Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- N-central upgrade to version 2025.3.1 or later
How to find potentially vulnerable systems with runZero #
From the Service inventory, use the following query to locate potentially vulnerable assets:
_asset.protocol:http AND protocol:http AND has:html.title AND html.title:="N-central Login Redirect"
