CVE-2025-11700
Published: 12 November 2025
Summary
CVE-2025-11700 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in N-Able N-Central. Its CVSS base score is 8.4 (High).
Operationally, ranked in the top 2.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
N-able N-central versions prior to 2025.4 contain multiple XML External Entity (XXE) injection flaws, tracked as CWE-611. The issues allow crafted XML input to be processed by the application, resulting in unauthorized disclosure of information. The vulnerability carries a CVSS 4.0 score of 8.4, reflecting network attack vector, low attack complexity, and low privileges required.
An authenticated attacker with low privileges can supply malicious XML payloads over the network to extract sensitive data from the server. Successful exploitation yields high confidentiality impact on the primary system and limited secondary effects on confidentiality, integrity, and availability within the broader environment.
The vendor advisory published by N-able at https://me.n-able.com/s/security-advisory/aArVy0000000rabKAA addresses the issue and provides guidance on remediation, including the availability of a fixed release in version 2025.4.
The associated EPSS score currently stands at 0.5295 after reaching a peak of 0.6543, indicating moderate and sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-131914
Vulnerability details
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.