CVE-2025-8875: critical vulnerability in N-able N-central
Insecure Deserialization Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
N-able N-central has a critical flaw where it unsafely processes data from untrusted sources, allowing an attacker with local access to run malicious code on the system. This could give attackers complete control over the affected computer.
The vulnerability stems from insecure deserialization (CWE-502) of untrusted data in N-able N-central versions before 2025.3.1, enabling arbitrary code execution through crafted serialized objects accessible to local users. Exploitation requires local access and results in arbitrary code execution with system privileges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.