CVE-2025-8875

The vulnerability mechanism is based on improper handling of the data deserialization process — the application processes crafted, untrusted data without appropriate verification of its content. An authenticated user (PR:L level privileges required) can upload a malicious payload that is executed on the server-side during deserialization. The attack vector is network-based, and its exploitation does not require user interaction or special technical conditions.

Successful exploitation of the vulnerability allows an attacker to execute arbitrary code on the server (RCE), which combined with high impact on confidentiality, integrity, and availability of both the attacked system and related systems (SC:H/SI:H/SA:H), can lead to complete compromise of the infrastructure managed by N-Central.

N-Able N-Central must be immediately updated to version 2025.3.1 or later. The patch is available in accordance with the vendor's announcement published on August 13, 2025 at: https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/. Due to active exploitation, the update should be treated as a priority.

N-Able N-Central in all versions preceding 2025.3.1

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.