External risk intelligence

N-central Authentication Bypass via Path Traversal

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2025-11366

N-central is a remote monitoring and management (RMM) platform designed to be internet-facing to manage distributed endpoints and network infrastructure. As an edge-managed service used for administrative access across networks, it is typically deployed with public-facing web interfaces.

Path Traversal

N Able N Central

before 2025.4

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in N-central software versions prior to 2025.4. This issue could allow unauthorized access through a path traversal vulnerability, potentially impacting the confidentiality, integrity, and availability of the system. The main concern at this time is confirming relevance and exposure within our environment.

Unauthorized access is possible.
Affects a core management tool.
Assess and confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by accessing a publicly exposed N-central instance. By leveraging a path traversal vulnerability, they could bypass authentication controls, potentially gaining access to sensitive data or administrative functions.

Accessible over the network.
Path traversal bypasses authentication.
Unauthorized access to sensitive data.

Live Threat

Current exploitation, exposure, and threat context

Authentication bypass via path traversal in N-central could allow an unauthenticated attacker to access sensitive system information or execute unauthorized actions when the product is exposed to the network. The specific data or actions affected would depend on the attacker's ability to navigate the file system.

System data and configurations at risk.
Path traversal allows unauthorized file access.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

The N-central platform, used for remote monitoring and management, is internet-facing and accessible via web interfaces, making it a target for external threats. Given its role in managing distributed endpoints and network infrastructure, responsibility for addressing this vulnerability likely falls to a combination of infrastructure, platform, and security teams, in coordination with vendor management. The first practical step is to identify all N-central instances, confirm their external reachability and business criticality, and then assign ownership to a specific team for remediation planning.

Identify N-central instances and their owners.
Verify external reachability and business criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is N-able N-central?

N-central is a remote monitoring and management (RMM) software platform. IT service providers and administrators use it to oversee and manage the health, security, and configuration of distributed endpoints, servers, and network infrastructure from a centralized dashboard.

What does path traversal mean for CVE-2025-11366?

This vulnerability, classified as CWE-22, involves improper restrictions on file paths. It allows an attacker to manipulate input to access files or directories outside the intended location. In the context of this CVE, this weakness is used to bypass authentication controls and gain unauthorized entry into the application.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted requests to the N-central instance that leverage the path traversal flaw. This action does not require legitimate user credentials to succeed. However, the flaw cannot be exploited if the system is not reachable over the network or if the application has been updated to version 2025.4 or later.

Is my N-central instance at risk?

If you are running a version earlier than 2025.4, your instance is vulnerable. According to Halo Surface Signal, N-central is frequently deployed as an internet-facing service to manage remote networks, which significantly increases the likelihood that it is accessible to external attackers. You should consider any internet-exposed instance as a high priority for review.

How do I respond to this vulnerability?

The most effective response is to update your N-central software to version 2025.4 or newer. Before applying the fix, identify all deployed instances, confirm their specific network accessibility, and coordinate with the team responsible for infrastructure maintenance to schedule the update and verify that the remediation is successfully applied.

References

me.n-able.com/s/security-advisory/aArVy0000000rcDKAQ/cve202511366-n…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.