PT-2025-46664 · Solarwinds · N-Central

Published 2025-11-12 · Updated 2026-04-14 · CVE-2025-11700

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2025.4

Description N-central versions prior to 2025.4 are susceptible to an XML External Entities injection that could lead to information disclosure. This issue allows for the potential exposure of sensitive data.

Recommendations Update N-central to version 2025.4 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-11700

Affected Products

N-Central

References · 12

• https://me.n-able.com/s/security-advisory/aArVy0000000rabKAA/cve202511700-ncentral-importservicefromfile-xxe-injection · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11700 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11700 · Security Note
• https://twitter.com/ctiwatchcloud/status/2043871988674912450 · Twitter Post
• https://me.n-able.com/s/security-advisory/aArVy0000000rabKAA · Note
• https://twitter.com/leak_ix/status/1991522373384688036 · Twitter Post
• https://t.me/CSIRT_italia/2929 · Telegram Post
• https://twitter.com/CVEnew/status/1988721730664153498 · Twitter Post
• https://t.me/CSIRT_italia/2931 · Telegram Post
• https://leakix.net/search?q=%2Bplugin%3ANCentralPlugin&scope=leak · Reddit Post
• https://twitter.com/VulmonFeeds/status/1988746686424822038 · Twitter Post
• https://t.me/CSIRT_italia/2985 · Telegram Post