Insecure Deserialization Vulnerability
Affects on-premises N-central releases before 2025.3.1. Fixed in 2025.3.1.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 2025.3.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
N-able N-central, a remote monitoring and management platform for managed service providers, is affected by this vulnerability. An attacker with local access could exploit the flaw, which involves deserializing untrusted data, to run arbitrary code on the system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
Timeline
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CVE published
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
- N-able N-central
fixed in 2025.3.1
References 1
status.n-able.com
Questions about CVE-2025-8875
What does this mean?
N-central has an insecure deserialization flaw. The advisory says it poses a potential risk to the security of the N-central environment if left unpatched.Source: status.n-able.com
Am I affected, and how do I check?
On-premises N-central releases before 2025.3.1 are affected. Compare the installed on-premises N-central release against 2025.3.1 to see whether it falls in that range.Source: status.n-able.com
What should I do about it?
Upgrade on-premises N-central to 2025.3.1, the fixed version. No workaround is listed in the facts.Source: status.n-able.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-08-13, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data