CVE-2025-8876: critical vulnerability in N-able N-central
Command Injection Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
N-able N-central fails to properly validate user input, allowing attackers to inject and execute arbitrary operating system commands on affected systems. This critical flaw can lead to complete system compromise.
An OS command injection vulnerability exists in N-central versions prior to 2025.3.1 due to improper input validation (CWE-20). An attacker can inject malicious commands through unsanitized user input, achieving remote code execution with system-level privileges. Exploitation requires network access to the affected N-central instance.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.