Cyber Resilience

CVE-2025-11700

High

Published: 12 November 2025

Published
12 November 2025
Modified
15 December 2025
KEV Added
Patch
CVSS Score v4 8.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.5295 98.0th percentile
Risk Priority 49 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11700 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in N-Able N-Central. Its CVSS base score is 8.4 (High).

Operationally, ranked in the top 2.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

N-able N-central versions prior to 2025.4 contain multiple XML External Entity (XXE) injection flaws, tracked as CWE-611. The issues allow crafted XML input to be processed by the application, resulting in unauthorized disclosure of information. The vulnerability carries a CVSS 4.0 score of 8.4, reflecting network attack vector, low attack complexity, and low privileges required.

An authenticated attacker with low privileges can supply malicious XML payloads over the network to extract sensitive data from the server. Successful exploitation yields high confidentiality impact on the primary system and limited secondary effects on confidentiality, integrity, and availability within the broader environment.

The vendor advisory published by N-able at https://me.n-able.com/s/security-advisory/aArVy0000000rabKAA addresses the issue and provides guidance on remediation, including the availability of a fixed release in version 2025.4.

The associated EPSS score currently stands at 0.5295 after reaching a peak of 0.6543, indicating moderate and sustained exploitation interest following disclosure.

EU & UK References

Vulnerability details

N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

n-able
n-central
≤ 2025.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-611

Penetration testing includes XML external entity payloads, detecting XXE vulnerabilities and enabling their mitigation.

addresses: CWE-611

Identifies XML external entity processing via monitoring of unusual file/network access or resource usage.

References