CVE-2025-8876: listed in the CISA KEV catalog

CVE-2025-8876 · CVSS 8.8 HIGH · EPSS 3% · KEV 2025-08-13 · patch available

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

Is CVE-2025-8876 exploited?

• Listed in the CISA KEV catalog on 2025-08-13.
• Federal remediation due 2025-08-20.
• Past that date by 434 days.
• EPSS puts exploitation in the next 30 days at 3%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• N-able · N-central · >= 0, < 2025.3.1

Is there a patch?

Yes. Update to one of these or later:

From N-able's CVE record

What PlainSec published about CVE-2025-8876

• Volt Typhoon used rotating relays to exploit management systems (2026-10-28)

Primary sources

• NVD record
• CISA KEV catalog

KEV and EPSS are re-checked daily. Record last updated 2026-10-28.