CVE-2025-8875

What it actually does

CVE-2025-8875 is an insecure deserialization flaw in N-able N-central versions before 2025.3.1. A vulnerable component accepts attacker-controlled serialized data and reconstructs it without sufficient validation, allowing a local attacker or attacker with equivalent access to trigger code execution in the security context of the affected N-central process. Because N-central is a remote monitoring and management platform, code execution on the server can expose administrative functions, stored credentials, automation capabilities, and downstream managed-system access depending on the privileges of the compromised service account.

Why it matters to the business

Compromise of an N-central server can have outsized operational impact because the platform is commonly used to manage, monitor, and automate activity across many endpoints and customer environments. An attacker who gains code execution may disrupt monitoring, tamper with alerts, steal credentials or configuration data, pivot into managed systems, or abuse legitimate RMM functionality for lateral movement. This vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and had a CISA remediation due date of 2025-08-20, so unpatched systems should be treated as high-priority exposure even though the EPSS score is currently low.

How an attack unfolds

An attacker first obtains local access to the N-central appliance or an equivalent path to interact with the vulnerable local component, such as through stolen credentials, prior compromise, exposed administrative functionality, or chaining with another vulnerability. The attacker then submits a crafted serialized object designed to abuse a deserialization gadget chain or unsafe object reconstruction path. When the N-central process deserializes the object, attacker-controlled code or commands execute with the privileges of that process. Post-exploitation activity may include creating persistence, reading configuration and credential material, modifying N-central jobs or scripts, deploying payloads through legitimate RMM workflows, disabling monitoring, or pivoting to managed endpoints. Active exploitation has been reported in the wild and the KEV listing indicates operational use by attackers; threat reporting references exploitation activity around N-able N-central insecure deserialization, with RomCom-related reporting also appearing in the provided context and warranting review during investigations.

How to fix it

Upgrade N-able N-central to version 2025.3.1 or later. Because this vulnerability is in CISA KEV and active exploitation is reported, prioritize emergency remediation for any internet-exposed, remotely administered, or high-value N-central server. If immediate upgrade is not possible, restrict access to N-central administrative and local service interfaces to trusted management networks, enforce MFA for administrative access, remove unnecessary local accounts, rotate credentials stored in or used by N-central, disable unused automation features, and increase monitoring until the system is patched. After remediation, assume exposed unpatched systems may have been targeted and perform compromise assessment before returning them to normal trust.

How to confirm the fix worked

Confirm the running N-central version is 2025.3.1 or later using the product administrative interface, appliance version command, or vendor-supported inventory method. Verify that all N-central nodes, appliances, and standby systems have been upgraded, not only the primary server. Confirm administrative access is restricted to approved networks and that no unsupported local access paths remain. Review vendor release notes or package manifests to ensure the deserialization fix is present. Where available, run an authenticated vulnerability scan or configuration audit that checks the installed N-central build. Validate that services restarted cleanly after upgrade and that no unexpected local users, scheduled jobs, scripts, or modified product files remain from the pre-patch period.

Typical attack path

1. Identify an N-central instance running a version earlier than 2025.3.1.
2. Obtain local access or another foothold that permits interaction with the vulnerable deserialization path.
3. Craft or reuse a malicious serialized payload compatible with the vulnerable component.
4. Submit the payload so the N-central process deserializes attacker-controlled data.
5. Achieve code execution under the vulnerable service context.
6. Enumerate N-central configuration, credentials, users, scripts, jobs, and managed endpoint relationships.
7. Establish persistence or deploy tooling using local system access or legitimate RMM automation features.
8. Pivot to managed systems, exfiltrate sensitive data, or disrupt monitoring and management operations.

How to detect it

Investigate whether exploitation occurred by reviewing N-central application logs, appliance operating system logs, authentication logs, web access logs, reverse proxy logs, EDR telemetry, shell history, scheduled tasks, and N-central audit trails from at least the publication date onward, with extra attention to the period before upgrade. Look for deserialization exceptions followed by service crashes, unusual Java stack traces, or unexpected child processes launched by N-central service accounts. Correlate successful or failed administrative logins, new users, privilege changes, API key creation, credential exports, script/job creation, probe or agent changes, and RMM tasks pushed to endpoints. On Linux-based appliances, review process execution telemetry for shells, download utilities, interpreters, or archive tools launched by Java or N-central processes. Review outbound connections from the N-central server to unfamiliar IPs or domains, especially immediately after application errors or suspicious login events. Because this is a KEV-listed vulnerability with active exploitation, absence of known IOCs is not sufficient; prioritize behavioral evidence such as unexpected command execution, unauthorized automation, credential access, and persistence changes.

• java.io.InvalidClassException
• java.io.StreamCorruptedException
• java.io.OptionalDataException
• java.io.WriteAbortedException
• ObjectInputStream
• readObject
• ysoserial
• AC ED 00 05
• bash -c
• sh -c
• /bin/bash
• /bin/sh
• curl
• wget
• nc -e
• ncat
• python -c
• perl -e
• chmod +x
• crontab -e
• /etc/crontab
• /etc/cron.d/
• /tmp/
• /var/tmp/
• powershell -enc
• cmd.exe /c
• certutil -urlcache
• rundll32.exe
• New administrator user
• API key created
• Scheduled task created
• Script added
• Probe configuration changed
• Agent deployment initiated

What your security team should do

• Immediately identify all N-able N-central instances and determine whether any are running versions earlier than 2025.3.1.
• Patch or upgrade affected systems to N-central 2025.3.1 or later; treat missed KEV remediation as an urgent risk exception.
• Restrict administrative and service access to trusted management networks and require MFA for administrator accounts.
• Perform compromise assessment on any instance that was unpatched after public disclosure or exposed to untrusted networks.
• Review N-central users, roles, API keys, stored credentials, automation scripts, scheduled tasks, probes, agents, and recently pushed jobs for unauthorized changes.
• Rotate credentials stored in or managed by N-central if exploitation is suspected or cannot be ruled out.
• Collect and preserve N-central application logs, operating system logs, web/proxy logs, authentication logs, and EDR telemetry before rebuilding or making major changes.
• Hunt for Java deserialization errors, suspicious child processes spawned by N-central services, unexpected outbound connections, and RMM-initiated activity that does not match normal administration.
• Monitor threat intelligence and vendor advisories for additional indicators, exploit details, or actor-specific reporting related to N-able N-central insecure deserialization.
• If compromise is suspected, isolate the N-central server from managed endpoints until the scope of attacker access is understood.