Attacks on N-able N-central ongoing, more than 1000 systems unpatched
More than a thousand instances of the RMM N-able N-central are still vulnerable to critical gaps. They are already under attack.
Symbol photo
(Image: DC Studio/Shutterstock.com)
Two security vulnerabilities have been discovered in the remote monitoring and management software (RMM) N-central from N-able, which allow attackers to inject commands into the operating system or execute malicious code that has been smuggled in. These are already being attacked on the Internet. IT researchers still see more than a thousand unpatched N-central instances, including many in Germany.
N-able does not provide in-depth details in the vulnerability entries. On the one hand, attackers can execute arbitrary code locally, as N-central deserializes untrusted data (CVE-2025-8875 / EUVD-2025-24823, CVSS 9.4, risk "critical"). Secondly, N-central does not adequately filter user input, allowing malicious actors to inject commands into the operating system (CVE-2025-8876 / EUVD-2025-24822, CVSS 9.4, "critical" risk).
Last week, the US IT security authority CISA included the vulnerabilities in the "Known Exploited Vulnerabilities" catalog. It is currently unclear what the attacks look like, and CISA is also not revealing the scope and extent.
Updated software corrects the errors
N-able fixes the security leaks with the update to N-central 2025.3.1. The manufacturer is silent on the current attacks in the version announcement –, which also includes the download link to the update –, but adds the note that authentication is required to exploit the vulnerabilities. Due to the high level of severity, however, this seems to be an easy hurdle to overcome.
Videos by heise
The Shadowserver Foundation published an evaluation of the Internet scans for X on the weekend. According to this, 1077 IP addresses were vulnerable to the vulnerabilities CVE-2025-8875 and CVE-2025-8876 last Friday.
The majority are located in the USA, Canada, the Netherlands, and the United Kingdom. However, around 50 systems in Germany were also accessible on the network and not protected against the security leaks. IT managers should install the update immediately to reduce the attack surface.
Cybercriminals are often very quick to exploit newly discovered vulnerabilities to break into networks. A vulnerability in Trend Micro's Apex One is also currently under active attack, for which a final patch is only now available to close the gap correctly.
(dmk)
