More than 800 N-able servers remain unpatched, exposing critical vulnerabilities.

Over 800 N-able N-Central servers remain unpatched against two critical security vulnerabilities, CVE-2025-8875 and CVE-2025-8876, which were reported as actively exploited last week. N-Central is a widely used platform by Managed Services Providers (MSPs) and IT departments for monitoring and managing networks and devices through a central web-based console. The vulnerabilities allow authenticated attackers to inject commands due to improper sanitisation of user input and to execute commands on unpatched devices by exploiting an insecure deserialization weakness. N-able has released a patch in N-Central version 2025.3.1 and has urged administrators to secure their servers promptly, as evidence of exploitation has been found in a limited number of on-premises environments, although no exploitation has been detected in N-able’s hosted cloud environments.

According to the internet security nonprofit Shadowserver Foundation, approximately 880 N-Central servers remain vulnerable, primarily located in the United States, Canada, and the Netherlands. The total number of exposed N-Central instances online is estimated to be around 2,000, as indicated by Shodan searches. The Cybersecurity and Infrastructure Security Agency (CISA) has added these vulnerabilities to its Known Exploited Vulnerabilities Catalog, designating them as exploited in zero-day attacks. CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies, including the Department of Homeland Security and the Department of Energy, must patch their systems within one week. While non-government organisations are not required to act, CISA has encouraged all network defenders to secure their systems against ongoing attacks, highlighting the significant risks posed by such vulnerabilities to the federal enterprise. 

Categories: Cybersecurity Vulnerabilities, Managed Services Providers, Patch Management 

Tags: N-able, N-central, Vulnerabilities, CVE-2025-8875, CVE-2025-8876, Exploitation, Security, Patch, Cybersecurity, CISA