CVE-2025-11366

The vulnerability classified as CWE-22 (path traversal) allows an attacker to manipulate network request paths in such a way as to bypass the application's authentication mechanisms. An attacker with only a low-privilege account (PR:L) can send a specially crafted HTTP request containing path traversal sequences that result in access to protected resources without the required authorization. The attack vector is network-based, without the need for physical access or user interaction on the victim's side.

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms and gain unauthorized access to the N-Central system, which according to the CVSS vector involves a high impact on the confidentiality, integrity, and availability of both the system itself and related systems.

N-Able N-Central must be immediately updated to version 2025.4 or later. Detailed information is available in the official security bulletin from the vendor at the address indicated in the references.

N-Able N-Central in versions prior to 2025.4