External risk intelligence

N-central Software Probe Remote Code Execution via Deserialization

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-11367

The N-able N-central Software Probe is typically deployed within a customer's environment to monitor local infrastructure and report back to a central server. While it requires network connectivity to communicate with the management console, it is not primarily designed as a public-facing edge gateway or internet-accessible service, making internet exposure less common than for central management servers.

Deserialization

N Able N Central

before 2025.4

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves the N-central Software Probe, affecting its ability to securely process data. The primary concern is confirming whether this specific technology is in use within the organization and, if so, understanding the potential exposure.

Software probe data processing flaw.
Confirm relevance and exposure to leadership.
Understand technology use and potential risk.

Attack Path

How an attacker could exploit the issue

An attacker could gain unauthorized access to the N-central Software Probe from anywhere on the network. By sending specially crafted data to the probe, they can trigger a flaw in how it processes information, potentially leading to the execution of malicious code on the affected system.

Network access required.
Malicious data triggers deserialization.
Remote code execution possible.

Live Threat

Current exploitation, exposure, and threat context

The N-central Software Probe, when running a version earlier than 2025.4, could allow an unauthenticated attacker to execute arbitrary code remotely. This could occur when the probe processes untrusted serialized data, potentially impacting the confidentiality, integrity, and availability of the system it is deployed on.

System data and service integrity.
Processing untrusted serialized data.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The N-central Software Probe, when deployed by Managed Service Providers (MSPs) or internal IT teams, presents a potential remote code execution risk through deserialization vulnerabilities. Identifying the specific instances of the affected probe version is the crucial first step, followed by assessing its network reachability and business criticality. Once identified, the accountable owner, likely within the platform or infrastructure team responsible for N-central, must be confirmed to coordinate the appropriate response, which may involve vendor coordination or planned maintenance for remediation.

Platform or infrastructure teams own the issue.
Verify probe deployment and network exposure.
Coordinate vendor patch or upgrade.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the N-central Software Probe?

The N-central Software Probe is a component used within N-able N-central environments. Its primary purpose is to monitor local infrastructure, collect system data, and report that information back to the central management console to support IT operations and visibility.

What does CVE-2025-11367 mean by deserialization?

This vulnerability, classified as CWE-502, occurs when the software takes untrusted, serialized data and converts it back into an object without sufficient validation. An attacker can exploit this process to inject malicious code, which the system then inadvertently executes.

How is this RCE flaw triggered?

An unauthenticated attacker triggers the flaw by sending specially crafted data to the affected software probe. The vulnerability is specifically tied to the processing of this untrusted serialized data; it is not triggered by standard, legitimate monitoring traffic or normal administrative communication between the probe and the management console.

Is my instance relevant to this CVE?

According to Halo Surface Signal, these probes are typically deployed inside private environments to monitor local networks. While they require network connectivity to talk to the console, they are not usually designed as public-facing gateways. However, you should check if your specific probe version is older than 2025.4.

How should I respond to this threat?

First, identify all instances of the N-central Software Probe running versions earlier than 2025.4 in your environment. Confirm which team owns these deployments, assess their network reachability, and coordinate with your infrastructure leads to plan the necessary upgrades or vendor-provided patches.

References

me.n-able.com/s/security-advisory/aArVy0000000rfRKAQ/cve202511367-n…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.