{"id":"CVE-2025-8875","published":"2025-08-14T15:15:43Z","modified":"2026-09-24T13:10:00Z","title":"N-able N-Central Insecure Deserialization Vulnerability","vendor":"N-able","product":"N-Central","tier":"core","eol":null,"description":{"text":"Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.","provenance":"source","from":"NVD"},"summary":{"text":"N-able N-Central contains an insecure deserialization flaw (CWE-502, deserialization of untrusted data) in the product's component handling, affecting versions before 2025.3.1. An attacker with local access and low privileges can trigger code execution by supplying crafted serialized data, requiring no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:28Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.02514,"percentile":0.84756,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-08-13","dueDate":"2025-08-20","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-8875","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-08-13","exploitedFirstSeen":"2025-08-13","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-08-13"},{"url":"https://x.com/rxerium/status/1957147780440264823","date":"2025-08-17"},{"url":"https://www.acn.gov.it/portale/w/n-able-rilevato-sfruttamento-in-rete-delle-cve-2025-8875-e-cve-2025-8876","date":"2025-08-20"},{"url":"https://hs-8813571.f.hubspotemail.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250903.pdf","date":"2025-09-03"},{"url":"https://www.recordedfuture.com/blog/august-2025-cve-landscape","date":"2025-09-15"},{"url":"https://www.rapid7.com/cdn/assets/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf","date":"2025-11-12"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework","date":"2026-10-28"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns","url":"https://otx.alienvault.com/pulse/6ae25986a5a09777ff89d848","created":"2026-10-28"},{"name":"Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns","url":"https://otx.alienvault.com/pulse/6ae259725b3c2c4fc06aa20e","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/","tags":["Release Notes"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8875","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Local access with low privileges required","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows Local Execution of Code","start":68,"end":98}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Deserialization yields arbitrary local code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows Local Execution of Code","start":68,"end":98}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-24823","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24823","exploited":true,"exploitedSince":"2025-08-13","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-08-17","earliestUrl":"https://github.com/rxerium/CVE-2025-8875-CVE-2025-8876","repos":[{"name":"rxerium/CVE-2025-8875-CVE-2025-8876","url":"https://github.com/rxerium/CVE-2025-8875-CVE-2025-8876","stars":22,"created":"2025-08-17"}]},"first":{"date":"2025-08-17","source":"PoC-in-GitHub","url":"https://github.com/rxerium/CVE-2025-8875-CVE-2025-8876"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2025-08-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2025-08-13","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-08-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24823","provenance":"source"},{"date":"2025-08-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8875","provenance":"source"},{"date":"2025-08-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/rxerium/CVE-2025-8875-CVE-2025-8876","provenance":"source"}],"speed":{"daysToPublicExploit":3,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 443 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.95,"detail":"percentile 0.8476"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}