{"id":"CVE-2025-9316","published":"2025-11-12T15:27:25Z","modified":"2025-11-12T18:26:46Z","title":"N-central unauthenticated sessionID generation","vendor":"N-able","product":"N-central","tier":"core","eol":null,"affectedVersions":[{"vendor":"N-able","product":"N-central","versions":["< 2025.4"]}],"description":{"text":"N-central < 2025.4 can generate sessionIDs for unauthenticated users\n\n\n\n\n\nThis issue affects N-central: before 2025.4.","provenance":"source","from":"CVE.org"},"summary":{"text":"The N-central product from N-able contains a flaw in its session handling, where versions before 2025.4 can generate sessionIDs for unauthenticated users. An attacker with network access can exploit this without authentication or user interaction, though the effect on confidentiality, integrity and availability is limited to low impact on confidentiality only.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:30Z"},"cvss":{"score":6.9,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.37387,"percentile":0.98526,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-12-15","exploitedFirstSeen":"2025-12-15","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-9316","date":"2025-12-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-18&host_type=src&vulnerability=cve-2025-9316","date":"2026-01-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-21&host_type=src&vulnerability=cve-2025-9316","date":"2026-01-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-31&host_type=src&vulnerability=cve-2025-9316","date":"2026-01-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-02-04&host_type=src&vulnerability=cve-2025-9316","date":"2026-02-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-02-08&host_type=src&vulnerability=cve-2025-9316","date":"2026-02-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-02-10&host_type=src&vulnerability=cve-2025-9316","date":"2026-02-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-02-11&host_type=src&vulnerability=cve-2025-9316","date":"2026-02-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-02-14&host_type=src&vulnerability=cve-2025-9316","date":"2026-02-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-02-18&host_type=src&vulnerability=cve-2025-9316","date":"2026-02-18"}],"evidenceTotal":115,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"MuddyWater Exposed: Inside an Iranian APT operation","url":"https://otx.alienvault.com/pulse/69acdc94b7bc2b107f5b8c7a","created":"2026-03-08"},{"name":"avault clone \"MuddyWater Exposed: Inside an Iranian APT operation\"","url":"https://otx.alienvault.com/pulse/69aa31beeac4a66ce154d29a","created":"2026-03-06"},{"name":"MuddyWater Exposed: Inside an Iranian APT operation","url":"https://otx.alienvault.com/pulse/69a99ec6f661182b3a0c1aa5","created":"2026-03-05"}],"provenance":"machine"},"cwes":[{"id":"CWE-1284","name":"Improper Validation of Specified Quantity in Input"}],"references":[{"url":"https://me.n-able.com/s/security-advisory/aArVy0000000rdpKAA/cve20259316-ncentral-unauthenticated-sessionid-generation","tags":[]}],"techniques":[],"reports":[{"id":"SRC-6456fe61781512dde412","title":"MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","publisher":"ctrlaltintel.com","url":"https://ctrlaltintel.com/research/MuddyWater/","date":"2026-03-04","mentions":[{"quote":"CVE-2025-9316 - N-Central improper access control","start":4257,"end":4306},{"quote":"MuddyWater also performed mass-exploitation of CVE-2025-9316, a vulnerability in SolarWinds N-central, a widely deployed RMM (Remote Monitoring & Management) platform used by MSPs.","start":9110,"end":9290},{"quote":"CVE-2025-9316 exploitation","start":9372,"end":9398}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-131915","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-131915","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":1,"earliest":"2025-11-14","earliestUrl":"https://github.com/horizon3ai/n-able_n-central_xxe_file_read","repos":[{"name":"horizon3ai/n-able_n-central_xxe_file_read","url":"https://github.com/horizon3ai/n-able_n-central_xxe_file_read","stars":3,"created":"2025-11-14"}]},"metasploit":[{"name":"N-able N-Central Authentication Bypass and XXE Scanner","module":"auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe","type":"auxiliary","disclosureDate":"2025-11-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb"}],"nuclei":[{"id":"CVE-2025-9316","name":"N-central - Authentication Bypass","severity":"medium","path":"http/cves/2025/CVE-2025-9316.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-9316.yaml"}],"first":{"date":"2025-11-14","source":"PoC-in-GitHub","url":"https://github.com/horizon3ai/n-able_n-central_xxe_file_read"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-11-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-9316","provenance":"source"},{"date":"2025-11-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2025-11-17","url":"https://github.com/horizon3ai/n-able_n-central_xxe_file_read","provenance":"source"},{"date":"2025-12-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-9316","provenance":"source"},{"date":"2026-03-04","kind":"report","label":"Named in ctrlaltintel.com: MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","url":"https://ctrlaltintel.com/research/MuddyWater/","provenance":"machine"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":74.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 319 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.71,"detail":"percentile 0.9853"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":4.83,"detail":"base score 6.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}