CVE-2025-9316

N-able N-central versions before 2025.4 contain a flaw (CWE-1284, improper validation of an input quantity) that allows the server to generate session IDs for unauthenticated users. An attacker can trigger this remotely over the network with no privileges or user interaction required. Per the CVSS 4.0 score of 6.9 (medium), the impact is limited to confidentiality (VC:L), meaning an attacker can obtain or create session identifiers without authenticating, potentially enabling session hijacking or unauthorized access to the N-central console. Any organization running N-central prior to 2025.4 — primarily managed service providers (MSPs) using the RMM platform — is affected. No public proof-of-concept exists and the flaw is not in CISA's KEV catalog, but the EPSS score of 36.3% (98th percentile) indicates an elevated probability of exploitation in the next 30 days.

What to do: Upgrade N-central to version 2025.4 or later. Until patched, restrict internet exposure of N-central consoles via VPN or firewall allowlisting, review active sessions for anomalies, and monitor the vendor's security advisories given the elevated EPSS likelihood.