CRITICAL Actively exploited CWE-502
CVE-2025-8875
Insecure Deserialization Vulnerability
N-able·N-Central
9.4/ 10
CVSS 4.0
Critical severity
2.3%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 84% of all CVEs
Listed
CISA KEV catalog
- Added
- Aug 13, 2025
- Fix due
- Aug 20, 2025
- Ransomware
- Not known
Timeline
- Published
- Aug 14, 2025
- Updated
- Oct 21, 2025
- First covered
- Oct 29, 2026
- Latest story
- 2 weeks ago
Summary
Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
CWE-502Deserialization of Untrusted Data
Attack profile
Attack vectorNetwork
ComplexityLow
RequirementsNone
PrivilegesLow
User interactionNone
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- N-able N-centralbefore 2025.3.1