N-able N-central CVE-2025-10231

Exploitation requires the target host to be running the N-able N-central Windows Agent or Probe, and the attacker must already possess local low-privileged access to that host (interactive or code-execution foothold). The concrete prerequisite is the agent's incorrect default file/directory permissions (CWE-276) allowing a low-privilege user to write to or replace content that the privileged agent service subsequently executes. Limiting factors: no remote vector (AV:L), no unauthenticated path (PR:L requires an existing account/foothold), impact is confined to the single host (S:U), and successful escalation depends on the agent being installed and running in its privileged service context.

All signals point to a genuine but modest, locally-scoped privilege-escalation issue rather than a mass-exploitation priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) is internally consistent with the description: a local, already-authenticated low-privilege user abuses incorrect default file/directory permissions (CWE-276) on the N-central Windows Agent/Probe to execute commands with elevated (SYSTEM-level) rights, yielding full C/I/A impact on the single host (S:U). EPSS is essentially floor-level at 0.01% (2nd percentile), the CVE is NOT on CISA KEV, and no public PoC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the signals: the low EPSS is expected for a local privesc that requires pre-existing footholds and cannot be sprayed remotely. The one metadata concern is the 'Microsoft' tag - this is an N-able (formerly SolarWinds MSP) product that merely runs on Windows; Microsoft is not the vendor. Bottom line: a real, patch-worthy local privesc that is a priority on endpoints where an attacker may already have a low-privilege foothold (and notably relevant because RMM agents run everywhere in an MSP estate), but not an emergency internet-facing threat.

An attacker who already has a low-privileged local account or code-execution foothold on a machine running the N-central Windows Agent or Probe discovers that agent files/directories carry overly permissive default ACLs. By replacing or planting a file that the privileged agent service later reads or executes, the attacker has their commands run in the agent's elevated context, achieving SYSTEM-level control of the host. No public exploit code is currently identified, and exploitation requires prior local access (AV:L, PR:L).