Actively exploited · Published Aug 14, 2025 · Assigned by N-able
CVE-2025-8876Command Injection Vulnerability
Critical 9.4 Exploited
In plain English
A critical-severity improper input validation in N-central from N-able. Attackers are actively exploiting it in the wild (listed by CISA on August 13, 2025). The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 20, 2025.
Official description
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H