Command Injection Vulnerability
Affects on-premises N-central installations before 2025.3.1, which must be upgraded to 2025.3.1. CVSS rates it critical (9.4); the vendor gave no separate rating.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 2025.3.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
N-able N-central, a remote monitoring and management platform, is affected by this vulnerability. An attacker could exploit improper input validation to inject operating system commands, potentially allowing them to run unauthorized commands on the affected system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
Timeline
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CVE published
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
- N-able N-central
fixed in 2025.3.1
References 1
status.n-able.com
Questions about CVE-2025-8876
What does this mean?
The advisory describes a command injection flaw in N-central, which is a risk to the security of the N-central environment if the installation is left unpatched. The facts do not give further technical detail on how the injection works.Source: status.n-able.com
Am I affected, and how do I check?
On-premises N-central installations at versions before 2025.3.1 are listed as affected. To check, look up the N-central version in the product's settings or about page and compare it with 2025.3.1.Source: status.n-able.com
What should I do about it?
Upgrade on-premises N-central to version 2025.3.1, which is the listed fixed version.Source: status.n-able.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-08-13, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data