Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-08-20. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-04 | 2 | Active Exploitation2 |
| 2026-10-28 | 1 | Patch1 |
| 2026-10-29 | 1 | Active Exploitation1 |
Fixed builds: VeloCloud Orchestrator 5.2.3.14/6.1.3.4/6.4.2.4/7.0.0.1 (CVE-2026-16812), Cisco SD-WAN CVE-2026-20127, N-central 2025.3.1 (CVE-2025-8875/8876), Versa Director 22.1.4 (CVE-2024-39717). Patching won't evict an actor already inside.
Post summary
The post lists patched versions for multiple products addressing several CVEs, highlighting that applying the fixes may not remove an already present attacker.
Zero-Day Exploitation Campaigns: - Versa Director (CVE-2024-39717): Zero-day file upload vulnerability used to deploy the bespoke VersaMem web shell for credential harvesting. - N-able N-central (CVE-2025-8875 & CVE-2025-8876): Insecure deserialization and command injection flaws. - Cisco Catalyst SD-WAN Controller (CVE-2026-20127): Authentication bypass vulnerability. - Arista VeloCloud Orchestrator (CVE-2026-16812): OS command injection vulnerability. - Quest KACE (Suspected Zero-Day): Exploited prior to patching in October 2025, affecting over 30 victim organizations
Post summary
The text reports active exploitation of multiple zero-day and known vulnerabilities, including VersaMem web shell deployment and exploitation of Quest KACE prior to patching in October 2025.
Myth: Exploitations don’t happen in real-world environments. Truth: CISA confirmed active use of CVE-2025-8875 & CVE-2025-8876 in on-premises setups of N-central. Stay alert and make the necessary updates now! #CyberMyths #InfoSec
Post summary
The tweet confirms that CVE‑2025‑8875 and CVE‑2025‑8876 are actively exploited in on‑premises N‑central deployments, urging users to apply updates.
CISA just started a three-day clock on a vulnerability N-able still hasn't scoped. On August 3, CISA added CVE-2026-18577 — N-able N-central's auth-bypass flaw — to its KEV catalog, triggering BOD 26-04's three-day remediation window. Federal agencies must patch by August 6. Huntress now confirms exploitation across multiple organizations, not the single case reported a day earlier. Attackers are logging in via a default "MSP Support" account, targeting domain controllers, and moving laterally from IPs on Mullvad and NordVPN exit nodes. Three days is workable if you've automated patch verification and compromise triage. For everyone else, it forces the investment that should have happened already. This is the second August in a row N-central hit CISA's KEV catalog for a zero-day — CVE-2025-8875/8876 were weaponized in nearly the same week last year. N-able still hasn't said how many customers this one compromised. If you run N-central: 2026.3.1.7 isn't the finish line. Check for the "Cloudflared" service, svchost.exe in Documents, and connections from N-able's four flagged IPs — the exploitation window predates the hotfix. If a KEV addition gave you three days starting tomorrow, could you finish inside it? Full details: https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html #Cybersecurity #CISA #MSP
Post summary
CISA’s KEV entry for CVE‑2026‑18577 is confirmed in the wild by Huntress, with attackers exploiting an N‑able N‑central auth‑bypass and using default MSP accounts to log into domain controllers. The advisory urges federal agencies to patch by August 6 and emphasizes ongoing exploitation risks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | n-able | n-central | - | - | - |