CVE-2025-8875: listed in the CISA KEV catalog

CVE-2025-8875 · CVSS 7.8 HIGH · EPSS 2% · KEV 2025-08-13 · patch available

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

Is CVE-2025-8875 exploited?

• Listed in the CISA KEV catalog on 2025-08-13.
• Federal remediation due 2025-08-20.
• Past that date by 434 days.
• EPSS puts exploitation in the next 30 days at 2%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• N-able · N-central · >= 0, < 2025.3.1

Is there a patch?

Yes. Update to one of these or later:

From N-able's CVE record

What PlainSec published about CVE-2025-8875

• Volt Typhoon used rotating relays to exploit management systems (2026-10-28)

Primary sources

• NVD record
• CISA KEV catalog

KEV and EPSS are re-checked daily. Record last updated 2026-10-28.