CVE-2025-11367 is a Critical severity (CVSS 9.8) remote code execution flaw in the N-able N-central Software Probe, caused by insecure deserialization. The record says versions before 2025.4 are vulnerable. Upgrade to 2025.4 or later and read the N-able advisory for the full details.
What's affected
The record says the N-central Software Probe before 2025.4 is vulnerable to remote code execution via deserialization. The weakness type is CWE-502 (deserialization of untrusted data). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, so it is network reachable, needs no login and no user interaction, and can affect confidentiality, integrity and availability.
The vendor advisory title refers to the Windows Software Probe. Beyond that, the record does not list fixed hotfixes or workarounds, and the advisory page did not render for me outside a browser. Verify the exact scope before you decide which machines are in play.
A probe is software that discovers and monitors devices on a network. It often runs with broad access, which is why a flaw here is rated so high.
How to check if you're exposed
Open the N-central console and look at the probe versions it reports, along with the server version. Compare both with 2025.4.
On each Windows machine that hosts a probe, check the installed program list for the N-able probe component and its version. Also note which network segments those hosts can see, since that decides how far a compromise would reach.
Check firewall rules to see which systems can connect to the probe host, and review recent logins and process activity on those machines.
What to do now
- Make a list of every N-central server and probe you run.
- Upgrade to 2025.4 or later by following the N-able advisory. Update the probes as well as the server.
- Limit inbound access to probe hosts to the systems that need to reach them.
- Review local accounts, scheduled tasks and installed software on probe hosts for changes you did not make.
- Record the upgrade date for each host so you can show when the exposure ended.
Why it matters
Deserialization means rebuilding objects from data the program receives. If the data is untrusted and the program does not restrict what can be rebuilt, the sender can influence code that runs. The usual remedies are to avoid native deserialization of outside data, to validate and allow list types, or to switch to plain data formats.
An RMM probe sits inside the customer network with the trust that implies, so a code execution flaw there is a foothold. The record does not list this CVE in CISA KEV and I found no source reporting exploitation, but the score and the network position justify prompt patching.
Quick check
Does this affect the N-central server or only the probe?
The record names the Software Probe, and the vendor advisory title says Windows Software Probe. Check the advisory for the exact scope and update both the server and probes to 2025.4 or later.
Is there a workaround?
The record lists none. Restricting network access to probe hosts reduces exposure, but the fix is the upgrade.
Sources
- N-able security advisory for CVE-2025-11367 (vendor page, which loads dynamically, so read it in a browser)
- NVD record for CVE-2025-11367 (description, CVSS vector, CWE)
You can also run the free in-browser dependency scan against your own application dependencies while you work through vendor patches.
Last reviewed: 19 October 2026.
