N Central
CVE-2025-11700
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 8.4, EPSS 51.2%. N-central is a major RMM platform used by MSPs to manage thousands of client endpoints. Compromising the RMM server provides access to every managed device's credentials, enabling supply chain attacks against all MSP customers simultaneously. |
| Exploit ScenarioDerived | An attacker sends XML requests with XXE payloads to N-central endpoints. They extract the N-central configuration files containing database credentials and API keys. They access the management database to obtain credentials for all managed endpoints across multiple MSP customers, enabling mass deployment of ransomware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
N-able N-central remote monitoring and management platform versions before 2025.4 contain multiple XML External Entity injection vulnerabilities. Attackers can exploit these to read sensitive files from the RMM server, including configuration files containing credentials for all managed endpoints.
Earlier versions of this analysis (1)
Multiple XXE injection vulnerabilities in N-central RMM platform expose sensitive server files and managed endpoint credentials.
RemediationAI
Update to N-central 2025.4 or later. Disable XML external entity processing. Rotate all managed endpoint credentials. Review RMM audit logs for unauthorized access. Implement network segmentation for RMM infrastructure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
N-central's XML processing endpoints fail to disable external entity resolution. An attacker can inject XXE payloads that read local files from the N-central server. As an RMM platform, the server stores credentials, API keys, and configuration data for all managed devices and endpoints in the customer base.
Know when N Central gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L
Primary rating from Vendor (a5532a13-c4dd-4202-bef1-e0b8f2f8d12b) · only source for this CVE.
CVSS VectorVendor: a5532a13-c4dd-4202-bef1-e0b8f2f8d12b
DescriptionCVE.org
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
Executive ViewAI
CVE-2025-11700 presents notable security risk, a XML external entity vulnerability rated CVSS 8.4. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. With an EPSS score of 51%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Pre-authentication remote code execution in N-able N-central before 2026.3.1.14 allows unauthenticated remote attackers
Authentication bypass and account takeover in N-able N-central through version 2026.3.1 stem from an incomplete remediat
Authentication bypass in N-able N-central through version 2026.1 allows unauthenticated remote attackers to circumvent a
N-able N-central before 2025.3.1 contains an OS command injection through improper input validation, companion vulnerabi
N-able N-central before 2025.3.1 contains a deserialization vulnerability allowing local code execution through crafted
The N-central server is vulnerable to an authentication bypass of the user interface. Rated critical severity (CVSS 9.8)
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. Rated hig
Authentication bypass in N-able N-central before version 2026.3 HF 3 permits low-privileged authenticated users to acces
SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain ad
Unauthenticated remote access to restricted internal APIs is possible in N-able N-central due to an incomplete access co
The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization. Rated critical severit
N-central < 2025.4 is vulnerable to authentication bypass via path traversal. Rated critical severity (CVSS 9.4), this v
GitHub PoC
Exploit-DB