Actively exploited · Published Aug 14, 2025 · Assigned by N-able
CVE-2025-8875Insecure Deserialization Vulnerability
Critical 9.4 Exploited
In plain English
A critical-severity unsafe deserialization in N-central from N-able. Attackers are actively exploiting it in the wild (listed by CISA on August 13, 2025). The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 20, 2025.
Official description
Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H