CVE-2025-8875

CVE-2025-8875 is a deserialization of untrusted data flaw (CWE-502) in N-able's N-central remote monitoring and management (RMM) platform, which runs on servers used by managed service providers to administer customer environments. An attacker can trigger it by getting the product to process crafted serialized data; the CVSS 4.0 vector indicates the attack is network-adjacent/over the network (AV:N) with only low privileges required (PR:L) and no user interaction. Successful exploitation yields code execution on the N-central server with high impact to confidentiality, integrity, and availability, giving attackers a foothold in a system that typically holds credentials and connectivity to many downstream customer networks. Any organization running an N-central release before 2025.3.1 is affected, primarily MSPs and the end customers they manage. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-08-13 after reported customer compromises, with EPSS estimating a 1.7% chance of exploitation within 30 days; no public proof-of-concept is known.

What to do: Upgrade N-central to 2025.3.1 or later and apply the vendor's latest hotfix (N-able has shipped a series of hotfixes for N-central flaws, including this one and the related CVE-2025-8876). As a CISA KEV entry, federal agencies must apply vendor mitigations per BOD 22-01 timelines or discontinue use if patching is unavailable. Given confirmed customer compromises, MSPs should also review N-central server logs for signs of exploitation, restrict internet exposure of the N-central interface, and rotate credentials stored in or accessible from the platform.