Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

N-able N-central authenticated command-execution flaws (multiple vulnerabilities)

Vulnerability
First reported
Last updated
Happening score
H score 53
2 unique sources, 2 articles

Summary

Hide ▲

CISA added CVE-2025-8875 and CVE-2025-8876 in N-able N-central to the KEV catalog, signaling active exploitation of authentication-required flaws that could enable command execution in on-premises environments. N-able said the issues were fixed in 2025.3.1 and 2024.6 HF2 on August 13, 2025. The vendor also urged customers to upgrade on-premises systems and enable MFA, especially for admin accounts.

Related Happenings

CISA KEV addition for Sierra Wireless ALEOS routers

Public Sector Action
H score33 First: 13.12.2025 14:33 Last: 13.12.2025 14:33 Sources 1

About this happening: CISA added CVE-2018-4063 to its KEV catalog, putting Sierra Wireless AirLink ALEOS routers under federal remediation pressure after reports of active exploitatio...

Open Happening

CISA KEV listing and federal deadline for React2Shell

Public Sector Action
H score89 First: 06.12.2025 13:40 Last: 06.12.2025 13:40 Sources 1

About this happening: CISA added CVE-2025-55182 to the KEV catalog after reports of active exploitation of React Server Components. The listing turns the React2Shell flaw into a fed...

Open Happening

Cybersecurity and Infrastructure Security Agency Emergency Directive 26-01 Mandated agencies apply the latest vendor update for at-risk F5 products for Federal Civilian Executive

Public Sector Action
H score62 First: 15.10.2025 15:00 Last: 15.10.2025 15:00 Sources 1

About this happening: CISA issued Emergency Directive 26-01 after identifying a significant cyber threat to federal networks using certain F5 devices and software. The directive requires ...

Open Happening

CISA adds CVE-2025-5086 to KEV catalog

Public Sector Action
H score38 First: 12.09.2025 14:03 Last: 12.09.2025 14:03 Sources 1

About this happening: CISA added CVE-2025-5086 affecting Dassault Systèmes DELMIA Apriso MOM to its Known Exploited Vulnerabilities (KEV) catalog, formalizing the flaw as an actively ex...

Latest development: 12.09.2025 19:19

Dassault Systèmes disclosed a deserialization of untrusted data vulnerability in DELMIA Apriso that can lead to remote code execution, affecting Release 2020 through Release 2025.

Open Happening

Microsoft enforces tenant-wide MFA for Azure Portal sign-ins

Security Tool/Service
H score21 First: 05.09.2025 22:32 Last: 05.09.2025 22:32 Sources 1

About this happening: Microsoft has enforced multifactor authentication (MFA) for Azure Portal sign-ins across 100% of Azure tenants, tightening admin access control and reducing takeover r...

Open Happening

Timeline

  1. 14.08.2025 07:02 1 articles · 11mo ago

    N-able releases fixes for N-central flaws

    Mitigation Patch Update

    N-able released N-central versions 2025.3.1 and 2024.6 HF2 to address CVE-2025-8875, an insecure deserialization issue that could lead to command execution, and CVE-2025-8876, a command injection issue tied to improper sanitization of user input. The vendor also urged customers to enable multi-factor authentication, especially for admin accounts, and to upgrade on-premises N-central to 2025.3.1.

    Show sources
    Open in new tab
  2. 14.08.2025 07:02 2 articles · 11mo ago

    CISA adds N-able N-central flaws to KEV catalog

    Legal Policy Action Update

    CISA added CVE-2025-8875 and CVE-2025-8876 affecting N-able N-central to the Known Exploited Vulnerabilities catalog after citing active exploitation. N-able said its investigations found this type of exploitation in a limited number of on-premises environments, saw no evidence of exploitation in N-able hosted cloud environments, and warned that Federal Civilian Executive Branch agencies should apply the necessary fixes by August 20, 2025.

    Show sources
    Open in new tab
  3. 14.08.2025 07:02 2 articles · 11mo ago

    CISA adds N-able N-central flaws to KEV catalog

    Legal Policy Action Update

    CISA added CVE-2025-8875 and CVE-2025-8876 affecting N-able N-central to the Known Exploited Vulnerabilities catalog after citing active exploitation. N-able said its investigations found this type of exploitation in a limited number of on-premises environments, saw no evidence of exploitation in N-able hosted cloud environments, and warned that Federal Civilian Executive Branch agencies should apply the necessary fixes by August 20, 2025.

    Show sources
    Open in new tab