Actively exploited in the wild
N-able N-Central Insecure Deserialization Vulnerability
N-able - N-Central · Listed in the CISA KEV since 2025-08-13. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-8875
HighCVSS 7.8KEVSummary
Deserialization of untrusted data vulnerability in N-able N-central allows local code execution. Affects versions before 2025.3.1.
Risk Assessment
An attacker with local access could execute arbitrary code, potentially leading to system compromise or privilege escalation.
Recommendation
Update N-able N-central to version 2025.3.1 or later to remediate the vulnerability.
Other vulnerabilities in N-able N-central
See all- CVE-2026-18556HighActively exploited
Authentication bypass using an alternate path or channel vulnerability in N-able N-central through version 2026.1 allows authentication bypass.
- CVE-2025-8876HighActively exploited
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection. This issue affects N-central before 2025.3.1.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.