CVE-2025-8876Active Exploitation(n-able / n-central)

MEDIUMCVSS 8.8 · HIGHCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch n-able n-central systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

n-able CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-08-20. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Other references

Weakness type (CWE)

CWE-20CWE-78

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

n-central

Threat summary

Active exploitation appears in 2 classified signals
Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 1 signal
Peaked 2d ago at 1 mentions (2026-08-02); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

n-able

Products

n-central

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Active Exploitation

266.7%

Patch

133.3%

Referenced assets1 URL

By indicator

https://nvd.nist.gov/vuln/detail/CVE-2025-8876?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer

Classification over time

Date	Total	Labels

2026-08-02	1	Patch1
2026-08-04	1	Active Exploitation1
2026-10-29	1	Active Exploitation1

Full discourse3 posts

calewnfd@calewnfd3d
Active Exploitation
Zero-Day Exploitation Campaigns: - Versa Director (CVE-2024-39717): Zero-day file upload vulnerability used to deploy the bespoke VersaMem web shell for credential harvesting. - N-able N-central (CVE-2025-8875 & CVE-2025-8876): Insecure deserialization and command injection flaws. - Cisco Catalyst SD-WAN Controller (CVE-2026-20127): Authentication bypass vulnerability. - Arista VeloCloud Orchestrator (CVE-2026-16812): OS command injection vulnerability. - Quest KACE (Suspected Zero-Day): Exploited prior to patching in October 2025, affecting over 30 victim organizations
Post summary
The text reports active exploitation of multiple CVEs in real-world campaigns, including web shell deployment for credential harvesting and exploitation prior to patching affecting over 30 organizations, with no indicated PoC code, exploit tools, patches, or false-positive claims.
000001
117 followersView on X
RHTG@RightHandTech89d
Active Exploitation
Myth: Exploitations don’t happen in real-world environments. Truth: CISA confirmed active use of CVE-2025-8875 & CVE-2025-8876 in on-premises setups of N-central. Stay alert and make the necessary updates now! #CyberMyths #InfoSec
Post summary
The post cites CISA confirmation of the active exploitation of CVE-2025-8875 and CVE-2025-8876 in on-premises N‑central installations and urges users to apply updates promptly.
0000038
102 followersView on X
Vistem Solutions@VistemSolutions91d
Patch
CVE-2025-8876 has been published in the NVD—another reminder that vulnerability management starts with trusted sources, fast validation, and prioritized action. What to do now: - Review the NVD entry and vendor guidance - Identify affected assets and exposure - Apply patches or mitigations when available - Monitor for suspicious activity - Document remediation for compliance and audit readiness 𝗩𝗶𝘀𝘁𝗲𝗺 𝗘𝗹𝗲𝘃𝗮𝘁𝗲 𝗽𝗼𝘄𝗲𝗿𝗲𝗱 𝗯𝘆 𝗩𝗶𝘀𝘁𝗲𝗺𝗦𝗲𝗰𝘂𝗿𝗲𝗣𝗿𝗼 helps organizations move from CVE awareness to measurable risk reduction with vCISO-led strategy, prioritized remediation, and continuous monitoring. Contact: sales@vistem.com #Cybersecurity #NVD #CVE #VulnerabilityManagement #PatchManagement #RiskManagement #ThreatIntel #CyberResilience #VistemElevate #VistemSecurePro #VistemSolutions https://nvd.nist.gov/vuln/detail/CVE-2025-8876?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer
Post summary
The post encourages users to review the CVE's NVD entry, follow vendor guidance, apply available patches or mitigations, and monitor activity as part of structured vulnerability management.
0000042
81 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	n-able	n-central	-	-	-

Explore more

Back to dashboard n-able CVEs n-central vulnerabilities

What researchers are saying

CVE-2025-8876

calewnfd[verified]@calewnfdActive Exploitation

The text reports active exploitation of multiple CVEs in real-world campaigns, including web shell deployment for credential harvesting and exploitation prior to patching affecting over 30 organizations, with no indicated PoC code, exploit tools, patches, or false-positive claims.

RHTG[verified]@RightHandTechActive Exploitation

The post cites CISA confirmation of the active exploitation of CVE-2025-8875 and CVE-2025-8876 in on-premises N‑central installations and urges users to apply updates promptly.

Vistem Solutions[verified]@VistemSolutionsPatch

The post encourages users to review the CVE's NVD entry, follow vendor guidance, apply available patches or mitigations, and monitor activity as part of structured vulnerability management.