CVE-2025-8875: N-able N-central deserialization of untrusted data allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 4.0 base score is 9.4 (critical) and the flaw is in CISA KEV with known exploitation, so it warrants immediate remediation.

What it is

N-able N-central contains a deserialization of untrusted data flaw (CWE-502) that permits code execution. It affects N-central versions before 2025.3.1, and the vendor released a fixed build. Because N-central is remote monitoring and management software, a compromise can expose managed endpoints and customer environments.

Impact

An attacker who can reach the vulnerable deserialization path can execute code in the context of the N-central service, with high impact to confidentiality, integrity and availability of both the vulnerable system and connected systems.

Attack surface

The CVSS 4.0 vector is network reachable (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), so an authenticated low-privileged user can trigger it remotely. No pre-authentication path is indicated by the record.

Exploitation

CVE-2025-8875 is listed in CISA KEV with a due date of 2025-08-20, indicating known exploitation in the wild. EPSS 30-day probability is 0.01721 (76th percentile), and no ransomware campaign use is documented.

What to do

• Upgrade N-central to 2025.3.1 or later per the vendor release notes.
• If immediate patching is not possible, apply the vendor mitigations referenced in the CISA KEV entry or discontinue use of the product.
• Restrict network access to the N-central management interface to trusted administrative networks.
• Review and reduce accounts with access to N-central, removing unnecessary low-privileged users.
• Monitor for post-exploitation activity on N-central hosts and connected managed endpoints.

Detection

• Hunt for unexpected child processes spawned by the N-central service or its application server.
• Review N-central and host logs for deserialization errors, unusual object payloads, or anomalous requests to management endpoints.
• Audit authentication and administrative activity for new or unexpected accounts and privilege changes.
• Check for outbound connections from N-central hosts to unfamiliar external addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.