CVE-2025-8876: N-able N-central improper input validation leads to OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 4.0 base score 9.4 with network reachability and CISA KEV listing indicating known exploitation.

What it is

N-able N-central before 2025.3.1 fails to properly validate input, allowing OS command injection. Because N-central is a remote monitoring and management platform, a compromise can expose managed endpoints and the administrative control plane. The flaw is rated critical (CVSS 4.0 score 9.4) and is listed in CISA KEV.

Impact

An authenticated attacker can execute arbitrary operating system commands on the N-central server, gaining high confidentiality, integrity and availability impact on the host and potentially on downstream managed systems.

Attack surface

Reachable over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), per the CVSS 4.0 vector. The description does not specify the exact endpoint or parameter, so the precise injection point is not documented in this record.

Exploitation

CVE-2025-8876 was added to CISA KEV on 2025-08-13 with a remediation due date of 2025-08-20, indicating known exploitation. EPSS 30-day probability is 0.0333 (87.996th percentile); no ransomware campaign use is documented.

What to do

• Upgrade N-central to 2025.3.1 or later, per the vendor release notes.
• If immediate patching is not possible, apply the mitigations in the vendor instructions referenced by CISA KEV or discontinue use of the product.
• Restrict network access to the N-central administrative interface to trusted management networks.
• Review and reduce accounts with access to the N-central server, and enforce least privilege.
• Monitor for signs of compromise on the N-central host and any managed endpoints.

Detection

• Hunt for unexpected child processes spawned by the N-central web/service processes on the server.
• Review N-central and OS logs for command execution or shell activity around administrative requests.
• Alert on unusual outbound connections from the N-central server to internal or external hosts.
• Audit authentication and administrative activity for anomalous or new accounts on the N-central server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.