What is the CVSS score of CVE-2025-8876?

CVE-2025-8876 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 7.8%.

Is CVE-2025-8876 being actively exploited?

Yes, CVE-2025-8876 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2025-8876?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

N Central CVE-2025-8876

CRITICAL

Improper Input Validation (CWE-20)

2025-08-14 a5532a13-c4dd-4202-bef1-e0b8f2f8d12b

Command Injection N Central N Able

9.4

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Impact	Critical risk (CVSS 9.4). Two independent code execution vectors in the same RMM platform indicate systemic security issues.
Exploit ScenarioDerived	Used as an alternative exploitation path when the deserialization vulnerability is mitigated.

Emergency Immediate action required. Why: CRITICAL + in CISA KEV (actively exploited), no patch available.

Exploited in the wild (CISA KEV) No patch listed yet 7.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

N-able N-central before 2025.3.1 contains an OS command injection through improper input validation, companion vulnerability to CVE-2025-8875.

Earlier versions of this analysis (1)

v1 Mar 28, 2026 - 19:06 CVSS 9.4

An OS command injection in N-able N-central through improper input validation provides another code execution path alongside the deserialization vulnerability.

RemediationAI

Apply updates for both CVEs simultaneously.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The CWE-20 input validation flaw allows OS command injection through unsanitized inputs, executing with the N-central service's privileges.

Know when N Central gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

Lifecycle Timeline

Added to CISA KEV

Oct 27, 2025 - 14:58 cisa

CISA KEV

CVE Published

Aug 14, 2025 - 15:15 nvd

CRITICAL 9.4

DescriptionCVE.org

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

Executive ViewAI

Why It Matters

Organizations using Improper Input Validation vulnerability in N-able N-central face critical risk from CVE-2025-8876, a input validation vulnerability rated CVSS 9.4. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score

7.8%

Top 8% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

CISA KEV

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC No

EPSS 7.8%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + in CISA KEV (actively exploited), no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

105

Low Medium High Critical

KEV: +50

EPSS: +8

CVSS: +47

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Affected Products (CPE)CVE.org

cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*

More in N Central

View all

CVE-2026-86218 CRITICAL Act Now POC

10.0 Sep 06

Pre-authentication remote code execution in N-able N-central before 2026.3.1.14 allows unauthenticated remote attackers

CVE-2026-18577 HIGH Act Now POC

8.2 Aug 02

Authentication bypass and account takeover in N-able N-central through version 2026.3.1 stem from an incomplete remediat

CVE-2026-18556 HIGH Act Now POC

8.2 Aug 01

Authentication bypass in N-able N-central through version 2026.1 allows unauthenticated remote attackers to circumvent a

CVE-2025-11700 HIGH Act Now POC

8.4 Nov 12

N-able N-central remote monitoring and management platform versions before 2025.4 contain multiple XML External Entity i

CVE-2025-8875 CRITICAL Emergency

9.4 Aug 14

N-able N-central before 2025.3.1 contains a deserialization vulnerability allowing local code execution through crafted

CVE-2024-28200 CRITICAL Act Now POC

9.8 Jul 01

The N-central server is vulnerable to an authentication bypass of the user interface. Rated critical severity (CVSS 9.8)

CVE-2020-15909 HIGH This Week POC

8.8 Oct 19

SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. Rated hig

CVE-2026-86207 HIGH This Week POC

7.7 Sep 05

Authentication bypass in N-able N-central before version 2026.3 HF 3 permits low-privileged authenticated users to acces

CVE-2020-7984 HIGH This Week POC

7.5 Jan 26

SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain ad

CVE-2026-86206 MEDIUM This Month POC

6.9 Sep 05

Unauthenticated remote access to restricted internal APIs is possible in N-able N-central due to an incomplete access co

CVE-2025-11367 CRITICAL Act Now

10.0 Nov 12

The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization. Rated critical severit

CVE-2025-11366 CRITICAL Act Now

9.4 Nov 12

N-central < 2025.4 is vulnerable to authentication bypass via path traversal. Rated critical severity (CVSS 9.4), this v

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique Command Injection

View all

CVE-2024-21887 CRITICAL POC

9.1

CVE-2019-15107 CRITICAL POC

9.8

CVE-2016-3081 HIGH POC

8.1

CVE-2024-51378 CRITICAL POC

9.8

CVE-2012-1823 CRITICAL POC

9.8

CVE-2016-1555 CRITICAL POC

9.8

CVE-2014-6271 CRITICAL POC

9.8

CVE-2024-55956 CRITICAL POC

9.8

References

Advisories & patches

REF https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/ REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8876

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back