CVE-2025-8876
Published: 14 August 2025
Summary
CVE-2025-8876 is a high-severity Improper Input Validation (CWE-20) vulnerability in N-Able N-Central. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses remediation of the known OS command injection flaw in N-central versions prior to 2025.3.1 via timely patching to the fixed release.
Enforces proper information input validation to block malicious inputs that enable OS command injection exploitation.
Scans for and remediates the high-severity vulnerability (CVSS 8.8, CISA KEV) through regular vulnerability monitoring and patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OS command injection via improper input validation on public-facing N-central server directly enables T1190 (initial access via exploited app) and T1059 (arbitrary command execution).
NVD Description
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
Deeper analysisAI
CVE-2025-8876 is an Improper Input Validation vulnerability (CWE-20) in N-able N-central that enables OS Command Injection (CWE-78). The issue affects N-central versions prior to 2025.3.1 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A low-privileged remote attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation allows arbitrary OS command execution on the affected system, resulting in high confidentiality, integrity, and availability impacts within the unchanged scope.
N-able announced the general availability of N-central 2025.3.1 on August 13, 2025, which mitigates the vulnerability. The issue is also listed in CISA's Known Exploited Vulnerabilities catalog.
This vulnerability has seen real-world exploitation, as indicated by its inclusion in the CISA KEV catalog.
Details
- CWE(s)
- KEV Date Added
- 13 August 2025