Critical N-able N-central vulnerabilities actively exploited
Take action: If you're using N-able N-central, make sure it's isolated from the internet and accessible only from trusted networks. Then update to version 2025.3.1 or hotfix 2024.6 HF2. If you can't isolate from the internet, this is a priority patch, since attackers will eventually phish someone and gain credentials.
Learn More
CISA is warning about two critical security vulnerabilities affecting N-able's N-central remote monitoring and management (RMM) platform that are currently being exploited by attackers.
N-able N-central is an RMM platform that enables MSPs and IT departments to monitor, manage, and maintain client networks and devices from a centralized web-based console. The platform supports management of Windows, Apple, and Linux endpoints, servers, mobile devices, and network equipment from various manufacturers including Dell, HP, Cisco, and Fortinet.
According to Shodan searches, approximately 2,000 N-central instances are currently exposed to the internet, with the majority originating from the United States, Australia, and Germany.
Vulnerabilities summary:
- CVE-2025-8875 (CVSS score 9.4) - An insecure deserialization vulnerability that allows authenticated attackers to execute arbitrary commands on the N-central server. This flaw is caused by improper handling of untrusted data during object deserialization processes, enabling remote attackers to gain unauthorized control over system functions.
- CVE-2025-8876 (CVSS score 9.4) - A command injection vulnerability caused by improper sanitization of user input. This flaw allows authenticated attackers to inject and execute arbitrary operating system commands on the underlying server infrastructure.
Both vulnerabilities require authentication to exploit, so attackers must have previously obtained credentials to access the N-central platform. Successful exploitation could lead to complete compromise of N-central instances, potentially allowing attackers to steal sensitive data, deploy malware on the managed systems networks, or gain persistent access.
N-able's security investigations have confirmed evidence of active exploitation in a limited number of on-premises environments. The company reports no evidence of successful attacks against N-able's hosted cloud environments.
N-able has patched both vulnerabilities through the release of N-central version 2025.3.1 and the hotfix version 2024.6 HF2, both available on August 13, 2025.
Organizations using N-central are strongly urged to upgrade to the patched versions. Those unable to update immediately should implement access controls to restrict Web interface visibility from the internet and ensure multi-factor authentication is enabled.
