N-able · N-central
The N-central product from N-able contains a flaw in its session handling, where versions before 2025.4 can generate sessionIDs for unauthenticated users. An attacker with network access can exploit this without authentication or user interaction, though the effect on confidentiality, integrity and availability is limited to low impact on confidentiality only.
N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.
First seen exploited 33 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Reports are matched by finding the exact id CVE-2025-9316 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
MuddyWater also performed mass-exploitation of CVE-2025-9316, a vulnerability in SolarWinds N-central, a widely deployed RMM (Remote Monitoring & Management) platform used by MSPs.
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.