CVE-2025-8876: N-able N-Central exploited

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

Description quoted from the CVE record (assigned by N-able, published 2025-08-14).

Weakness: CWE-20 Improper Input Validation

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing low privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA assessment (SSVC): CISA assesses exploitation as active. Automatable: no. Technical impact: total.

On CISA KEV since: 2025-08-13
US federal deadline: 2025-08-20
Ransomware use: Not known

Public exploit evidence (Exploit Observer)

Also known as: CNNVD-202508-1663, EUVD-2025-24822, GHSA-mv58-xq9x-f6c5

VEDAS cluster: VEDAS:FLUORITEFIREBIRD

Exploit Observer links 5 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (5)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/nuclei/2025/CVE-2025-8876.yaml
Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/nuclei/2025/CVE-2025-8876.yaml
Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2025/CVE-2025-8876.rules
Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2025/CVE-2025-8876.rules
Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2025/CVE-2025-8876.rules

Vulnerability databases and vendor advisories (5)

Catalogue entries, not exploit evidence.

Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2025-24822
Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-mv58-xq9x-f6c5
Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-8876
Vulnerability database or vendor advisory: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8876
Vulnerability database or vendor advisory: https://www.cnnvd.org.cn/home/globalSearch?keyword=CNNVD-202508-1663

4 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS: 0.041
some chance of attack soon
VEDAS: 0.987
strong exploit evidence
On CISA KEV: Yes, since 2025-08-13
Detection rule: Nuclei · Suricata

EPSS (chance of attack)

VEDAS (exploit evidence)

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Who is affected

Product	Affected	Not affected
N-able N-central	before 2025.3.1	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

Exploit Observer also maps it to: n-able n-central.

How to fix it

Fixed versions stated in the CVE record: 2025.3.1.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor guidance:

How to detect it

Nuclei template (active check)

Nable - Command Injection
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /login); it decides using dsl, regex, status, word matchers. Severity in the template: critical. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2025-8876.yaml

Show the template (42 lines)

yaml

id: CVE-2025-8876

info:
  name: "Nable - Command Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects
    N-central: before 2025.3.1.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-8876&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=nable&match=exact
  classification:
    cve-id: CVE-2025-8876
  metadata:
    verified: false
  tags: cve,cve2025,kev,n-able,ncentral,command-injection,rce,nable
http:
  - method: GET
    path:
      - "{{BaseURL}}/login"

    extractors:
      - type: regex
        name: version
        regex:
          - '202\d+\.\d+\.\d+\.\d+\b'
        part: body

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - 'class="ncentral"'

      - type: dsl
        dsl:
          - compare_versions(version, '< 2025.3.1.9')

CVE-2025-8876.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2025-8876 Nable - Command Injection. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2025-8876 Nable - Command Injection"; flow:established,to_server; http.uri; content:"login"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2025-8876; reference:url,https://www.exploit.observer/?keyword=CVE-2025-8876&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=nable&match=exact; sid:1011802; rev:1;)

CVE-2025-8876.rules on GitHub

References

Government sources

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8876 (government-resource)

Other references

https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, CISA KEV, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.