Vulnerabilities in MSP-friendly RMM solution exploited in the wild (CVE-2025-8875, CVE-2025-8876)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-8876 +1 in the same advisory: …8875 | OS Command Injection in N-able N-central Before 2025.3.1 N-able N-central, an RMM platform widely used by managed service providers, contains an OS command injection flaw (CWE-78) caused by improper input validation (CWE-20), allowing an attacker to execute arbitrary operating-system commands on the N-central server. The flaw is reachable over the network (AV:N) and requires only low-privileged access with no user interaction, per the CVSS 4.0 vector. Successful exploitation yields high impact on confidentiality, integrity, and availability, and the 'subsequent system' impacts indicate compromise can extend beyond the N-central server itself, putting all endpoints that the affected MSP manages at risk. All N-central deployments running versions before 2025.3.1 are affected. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-08-13 following reported customer compromises, though no public proof-of-concept is known and ransomware use is unknown. Do: Upgrade N-central to version 2025.3.1 or later immediately, as the flaw is under active exploitation and CISA KEV requires federal agencies to apply vendor mitigations per BOD 22-01 or discontinue use. MSPs should check their N-central servers for signs of compromise, review accounts for anomalous or low-privileged sessions, and assume downstream managed endpoints may be at risk given the subsequent-system impact. Note that this is one of two recently patched N-central flaws being exploited in the wild, so ensure all recent hotfixes (multiple releases in recent weeks) are applied. | 9.4 | 3% | KEV |
| largeon the order of tens of thousands of N-central server deployments (each server typically manages hundreds to thousands of downstream MSP client endpoints) |
Full article422 words · extracted from helpnetsecurity.com · click to collapse
Two vulnerabilities (CVE-2025-8875, CVE-2025-8876) in N-central, a remote monitoring and management (RMM) solution by N-able that’s popular with managed service providers, are being exploited by attackers.
There are no public reports of exploitation, but the confirmation came from the US Cybersecurity and Infrastructure Security Agency (CISA), which added the flaws to its Known Exploited Vulnerabilities catalog and ordered US federal civilian agencies to mitigate them within a week.
About the vulnerabilities (CVE-2025-8875, CVE-2025-8876)
N-able N-central is used by managed service providers (MSPs) and IT teams to keep track of, update, and secure large fleets of endpoints from a central dashboard. It supports a wide range of devices: workstations, servers, mobile devices, and network equipment from various manufacturers like Dell, HP, Cisco and Fortinet.
CVE-2025-8875 is an insecure deserialization vulnerability and CVE-2025-8876 a command injection vulnerability. They have yet to be assigned a CVSS score and N-able is only planning to release furtner details about the three weeks from now.
The only information that the company shared is that the vulnerabilities require attackers to authenticate themselves (i.e., they must have valid account credentials) before being able to exploit them, and that, if the vulnerabilities remain unpatched, “there is a potential risk to the security of [customers’] N-central environment”.
The flaws have been fixed in N-central v2025.3.1 and N-central v2024.6 HF2, which have been released on Wednesday, and the company urged customers to upgrade their on-premises installations to one of those versions.
CISA couldn’t confirm that the vulnerabilities are being leveraged in ransomware delivery campaigns, but attackers have been known to compromise solutions used by MSPs to get to their customers’ systems and networks.
UPDATE (August 14, 2025, 10:10 a.m. ET):
N-able has told Help Net Security that the vulnerabilities could allow a threat actor to elevate their privileges and maliciously use N-central.
“Our security investigations have shown evidence of this type of exploitation in a limited number of on-premises environments. We have not seen any evidence of exploitations within N-able hosted cloud environments,” a company spokesperson shared.
“We acted quickly to release a hotfix to address these vulnerabilities, which we have communicated to all N-central customers. Our commitment to security and transparency will continue; we have reserved two CVEs (CVE-2025-8875, CVE-2025-8876) that relate to this hotfix which we will release in the coming weeks. We’ll update customers with any additional information that becomes available as our investigation continues into this matter.”
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/08/14/vulnerabilities-in-msp-friendly-rmm-solution-exploited-in-the-wild-cve-2025-8875-cve-2025-8876/