N-Able N-Central vulnerabilities

CVE-2025-8876 [HIGH] CWE-20 CVE-2025-8876: Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue a Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

CVE-2025-8875 [HIGH] CWE-502 CVE-2025-8875: Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.T Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

CVE-2025-11700 [HIGH] CWE-611 CVE-2025-11700: N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to in N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure

CVE-2025-9316 [MEDIUM] CWE-1284 CVE-2025-9316: N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-centr N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.

CVE-2024-28200 [CRITICAL] CWE-288 CVE-2024-28200: The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerabi The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered through internal N-central source code review and N-able has not observed any exploitation in the wild.

CVE-2025-11366 [CRITICAL] CWE-22 CVE-2025-11366: N-central < 2025.4 is vulnerable to authentication bypass via path traversal N-central < 2025.4 is vulnerable to authentication bypass via path traversal

CVE-2025-11367 [CRITICAL] CWE-502 CVE-2025-11367: The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization

CVE-2024-5322 [CRITICAL] CWE-288 CVE-2024-5322: The N-central server is vulnerable to session rebinding of already authenticated users when using En The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. This vulnerability is present in all Entra-supported deployments of N-central prior to 2024.3.

CVE-2023-47132 [CRITICAL] CWE-269 CVE-2023-47132: An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls.

CVE-2025-7051 [HIGH] CWE-284 CVE-2025-7051: On N-central, it is possible for any authenticated user to read, write and modify syslog configurati On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.

CVE-2025-10231 [HIGH] CWE-276 CVE-2025-10231: An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in t An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions.

CVE-2023-30297 [HIGH] CVE-2023-30297: An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to exec An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server.

CVE-2024-8510 [MEDIUM] CWE-22 CVE-2024-8510: N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-I N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerability is present in all deployments of N-central prior to N-central 2024.6.