CVE-2025-9316: medium-severity vulnerability in N-able N-central
N-central unauthenticated sessionID generation
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
N-central versions before 2025.4 can create valid session IDs for users who haven't logged in. This allows attackers to impersonate users or bypass authentication checks.
N-central < 2025.4 generates valid sessionIDs without requiring prior authentication, enabling unauthenticated attackers to obtain legitimate session tokens. An attacker can leverage these tokens to access protected resources or perform actions as if they were an authenticated user, bypassing the application's access control mechanisms.
In the same product, most dangerous first.