CISA Adds Two N-able N-central Flaws to Known Exploited Vulnerabilities Catalog
CISA Adds Two N-able N-central Flaws to Known Exploited Vulnerabilities Catalog — Aug 14, 2025Ravie LakshmananVulnerability / Network Security Known Exploit
What’s new: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities affecting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The vulnerabilities are CVE-2025-8875, an insecure deserialization flaw leading to command execution, and CVE-2025-8876, a command injection vulnerability from improper user input sanitization. Both issues have been addressed in N-central versions 2025.3.1 and 2024.6 HF2, released on August 13, 2025.
Who’s affected
Organizations using N-able N-central for Remote Monitoring and Management (RMM) are at risk if they have not updated to the latest versions. The vulnerabilities require authentication to exploit, but pose a significant risk if unpatched.
What to do
- Upgrade N-able N-central to version 2025.3.1 or 2024.6 HF2 immediately.
- Ensure multi-factor authentication (MFA) is enabled for all admin accounts.
- Federal Civilian Executive Branch (FCEB) agencies should apply the necessary fixes by August 20, 2025.
