CVE-2025-8875

9.4

CRITICAL CVSS 4.0

N-able N-Central Insecure Deserialization Vulnerability - [Actively Exploited]

Description

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

INFO

Published Date :

Aug. 14, 2025, 3:15 p.m.

Last Modified :

Aug. 15, 2025, 3:15 p.m.

Remotely Exploit :

Yes !

Source :

a5532a13-c4dd-4202-bef1-e0b8f2f8d12b

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Aug 20, 2025

Alert Date: Aug 13, 2025 | 43 days ago

Description :

N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-8875

Affected Products

The following products are affected by CVE-2025-8875 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	N-able	n-central

: Total Affected Vendor : 1 | Products : 1

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				[email protected]
	CVSS 4.0	CRITICAL				a5532a13-c4dd-4202-bef1-e0b8f2f8d12b

Solution

Update N-central to the latest version to fix deserialization vulnerabilities.

Update N-central to version 2025.3.1 or later.
Apply vendor-provided security patches promptly.
Review and restrict deserialization of untrusted data.

Public PoC/Exploit Available at Github

CVE-2025-8875 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-8875.

URL	Resource
https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/	Release Notes

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-8875 is associated with the following CWEs:

CWE-502: Deserialization of Untrusted Data

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-8875 weaknesses.

CAPEC-586: Object Injection Object Injection

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

rxerium/CVE-2025-8875-CVE-2025-8876

Detection for CVE-2025-8875 & CVE-2025-8876

cisa detection kev ncentral nuclei vulnerability

Updated: 1 month ago

19 stars 5 fork 5 watcher

Born at : Aug. 17, 2025, 5:56 p.m. This repo has been linked 2 different CVEs too.

ums91/CISA_BOT

CISA Bot is a GitHub bot that automatically monitors the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog. When new vulnerabilities are published in the KEV, the bot creates GitHub issues in this repository with detailed information about each vulnerability.

Python

Updated: 3 weeks, 5 days ago

2 stars 1 fork 1 watcher

Born at : Oct. 29, 2024, 10:19 a.m. This repo has been linked 206 different CVEs too.

rxerium/stars

A list of all of my starred repos, automated using Github Actions 🌟

github-actions stars

Updated: 3 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Jan. 4, 2023, 11:20 a.m. This repo has been linked 20 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 1 day, 3 hours ago

7289 stars 1207 fork 1207 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 821 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-8875 vulnerability anywhere in the article.

europa.eu

Cyber Brief 25-09 - August 2025

Cyber Brief (August 2025)September 2, 2025 - Version: 1TLP:CLEARExecutive summaryWe analysed 321 open source reports for this Cyber Brief1.Relating to cyber policy and law enforcement, Ukraine, Romani ...

Published Date: Sep 02, 2025 (3 weeks, 1 day ago)

The Cyber Express

Chinese State Hackers Target Global Critical Infrastructure, NSA Warns

A coalition of cybersecurity and intelligence agencies from across the globe, including the United States National Security Agency (NSA), has issued a joint advisory revealing ongoing cyber intrusions ...

Published Date: Aug 28, 2025 (4 weeks ago)

CybersecurityNews

Weekly Cybersecurity News Recap : Apple 0-day, Chrome, Copilot Vulnerabilities and Cyber Attacks

This past week was packed with high-severity disclosures and active exploitation reports across the global threat landscape. At the forefront, Apple rushed out emergency patches for yet another zero-d ...

Published Date: Aug 24, 2025 (1 month ago)

The Cyber Express

CISA Warns of Critical ICS Flaws in Siemens, Tigo Energy, and EG4 Equipment

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) have released four new Industrial Control Systems (ICS) advisories. These advisories expose multiple vulnerabilities in widely used ICS ...

Published Date: Aug 22, 2025 (1 month ago)

The Cyber Express

DOM-Based Extension Clickjacking Exposes Millions of Password Manager Users to Credential Theft

A newly discovered technique, dubbed DOM-based extension clickjacking, has raised serious concerns about the security of browser-based password managers. Despite their role in protecting sensitive inf ...

Published Date: Aug 21, 2025 (1 month ago)

The Cyber Express

New HTTP/2 DoS Vulnerability Prompts Vendor and Project Fixes

A new HTTP/2 denial of service (DoS) vulnerability that circumvents mitigations put in place after 2023’s “Rapid Reset” vulnerability is largely being addressed by affected vendors and projects, thank ...

Published Date: Aug 18, 2025 (1 month ago)

BleepingComputer

Over 800 N-able servers left unpatched against critical flaws

Over 800 N-able N-central servers remain unpatched against a pair of critical security vulnerabilities tagged as actively exploited last week. N-central is a popular platform used by many managed serv ...

Published Date: Aug 18, 2025 (1 month ago)

CybersecurityNews

1000+ Exposed N-able N-central RMM Servers Unpatched for 0-Day Vulnerabilities

Over 1,000 exposed and unpatched N-able N-central Remote Monitoring and Management (RMM) servers are vulnerable to two newly disclosed zero-day vulnerabilities – CVE-2025-8875 and CVE-2025-8876. As of ...

Published Date: Aug 18, 2025 (1 month ago)

security.nl

'Honderden N-Central RMM-servers bevatten actief misbruikte kwetsbaarheden'

Op internet zijn bijna negenhonderd N-Central RMM-servers van leverancier N-Able te vinden, waarvan meer dan tachtig in Nederland, die twee actief misbruikte kwetsbaarheden bevatten. Dat laat The Shad ...

Published Date: Aug 18, 2025 (1 month, 1 week ago)

Help Net Security

Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: WinRAR zero-day was exploited by two threat actors (CVE-2025-8088) The RomCom attackers aren’t the onl ...

Published Date: Aug 17, 2025 (1 month, 1 week ago)

The Cyber Express

Qilin Remains Top Ransomware Group as Attacks Rise

Qilin continues to stake a claim as the top ransomware group in the wake of the decline of RansomHub earlier this year. In July, Qilin led all ransomware groups in claimed victims for the third time i ...

Published Date: Aug 15, 2025 (1 month, 1 week ago)

Help Net Security

Brute-force attacks hammer Fortinet devices worldwide

A surge in brute-force attempts targeting Fortinet SSL VPNs that was spotted earlier this month could be a portent of imminent attacks leveraging currently undisclosed (potentially zero-day) vulnerabi ...