CVE-2025-8875
N-able N-Central Insecure Deserialization Vulnerability
Description
CVE-2025-8875 is a high-severity deserialization of untrusted data vulnerability in N-able N-Central, the remote monitoring and management platform used by managed service providers worldwide. The vulnerability allows a locally authenticated attacker with low privileges to exploit insecure deserialization to execute arbitrary code on the N-Central server. Rated at a CVSS v3.1 score of 7.8, this vulnerability requires local access but no user interaction, and successful exploitation results in complete compromise of confidentiality, integrity, and availability. CISA added CVE-2025-8875 to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 20, 2025, and its EPSS score of 2.41% at the 84th percentile indicates notable exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| n-able | n-central | < 2025.3.1 |
References
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2025-8875 is classified under CWE-502 (Deserialization of Untrusted Data), a critical weakness where an application reconstructs objects from serialized data without verifying its integrity or safety. In N-able N-Central, certain components deserialize data from sources accessible to local users without validating the contents, allowing an attacker to craft malicious serialized payloads that trigger code execution during the deserialization process.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
The impact of CVE-2025-8875 is significant despite requiring local access. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H shows that while the attack vector is local (AV:L), exploitation complexity is low (AC:L) and only low-level privileges are needed (PR:L) with no user interaction required (UI:N). Confidentiality (High): successful deserialization exploitation grants the attacker access to all data on the N-Central server, including managed device credentials, client configurations, and sensitive monitoring data. Integrity (High): the attacker can modify any data or configuration on the server, deploy malicious scripts to managed endpoints, or inject persistent backdoors. Availability (High): code execution can be used to crash the N-Central service, corrupt data stores, or render the management platform inoperable. Given N-Central's role as a central management hub for MSP environments, local compromise of this system can cascade into a supply chain attack affecting all managed clients.
Exploit Maturity
CVE-2025-8875 has been confirmed as actively exploited, evidenced by its addition to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of August 20, 2025. The EPSS score of 2.41% at the 84th percentile places it in the upper tier of vulnerabilities likely to see exploitation. Deserialization vulnerabilities are well-understood by attackers, with established tooling and gadget chain libraries available for common frameworks. While the local access requirement limits remote exploitation, in enterprise environments where multiple users or services have local access to the N-Central server, or where an attacker has gained initial foothold through another vulnerability such as CVE-2025-8876 (the companion OS command injection flaw in the same product), this deserialization flaw becomes a powerful privilege escalation and persistence mechanism.
Remediation
-
Upgrade N-Central to version 2025.3.1 or later immediately. This release addresses the deserialization vulnerability alongside CVE-2025-8876. Refer to the N-Central 2025.3.1 release announcement for upgrade procedures.
-
Restrict local access to the N-Central server by limiting which user accounts and services can log in locally or access the server's file system. Remove unnecessary local accounts and enforce strong authentication for all remaining accounts.
-
Implement application whitelisting on the N-Central server to prevent unauthorized code execution. Tools like AppLocker or similar endpoint protection can block execution of untrusted binaries that might result from deserialization exploitation.
-
Monitor for anomalous process execution on the N-Central server, including unexpected child processes, unusual network connections, or file system modifications that could indicate deserialization-based code execution. Deploy EDR solutions configured to alert on suspicious behavior patterns.
-
Isolate the N-Central server within a dedicated network segment with strict ingress and egress controls. Ensure that even if the server is compromised, lateral movement to managed endpoints and client networks is restricted by network-level segmentation and access controls.
Technical Details
CVE-2025-8875 is a deserialization of untrusted data vulnerability in N-able N-Central with CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists because certain N-Central components process serialized objects from locally accessible sources without verifying that the data is safe or has not been tampered with. An attacker with local access and low-level privileges can craft a malicious serialized payload containing a gadget chain that, when deserialized by the application, triggers arbitrary code execution within the context of the N-Central process. This process typically runs with elevated privileges to manage system services and remote endpoints. The deserialization mechanism does not implement class filtering or allowlisting, allowing the attacker to instantiate arbitrary objects during reconstruction. N-Central versions before 2025.3.1 are affected, and the fix implements secure deserialization practices including input validation and class restrictions.
Frequently Asked Questions
Is CVE-2025-8875 being actively exploited?
Yes. CISA has added CVE-2025-8875 to the Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 2.41% at the 84th percentile indicates this vulnerability is being targeted more than most. The remediation deadline is August 20, 2025.
What products are affected by CVE-2025-8875?
N-able N-Central versions prior to 2025.3.1 are vulnerable. This affects all installations of N-Central that have not been updated to the patched release.
How do I fix CVE-2025-8875?
Upgrade to N-able N-Central version 2025.3.1 or later, which addresses the insecure deserialization. Additionally, restrict local access to the server, implement application whitelisting, and monitor for unusual process execution.
How severe is CVE-2025-8875?
CVE-2025-8875 has a CVSS v3.1 score of 7.8 (High severity). While it requires local access, exploitation complexity is low and leads to complete system compromise. Its inclusion in the KEV catalog underscores the urgency of patching.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.