CVE-2025-8875

This vulnerability is like a “dangerous shortcut” in how N-central reads data—under the wrong conditions, that shortcut can turn attacker-controlled data into instructions the system executes. If someone can reach the affected N-central installation and trigger the flaw, they may be able to run code and take control of the N-central server. Because N-central is used to manage other systems, a compromise can spread into broader operational disruption.

This matters if your business uses N-able N-central and the installed version is before 2025.3.1. It is a local attack (the attacker must have local access), and the findings indicate low authentication requirements, so the risk rises if the attacker can get onto the network path and reach the N-central environment. Since CISA confirms KEV exploitation, treat it as an active threat where the vulnerable server is reachable from the attacker’s position and the required access path is present.

This is RED because CISA has confirmed real-world exploitation (KEV), and there are reports of customer installations being breached. Attackers are actively targeting N-central environments, and exploitation can lead to code execution and takeover of administrative control. Act immediately: upgrade to the fixed version (2025.3.1) or apply the vendor’s mitigations without delay.