CVE-2025-11366 is a Critical severity (CVSS 9.8) authentication bypass through path traversal in N-able N-central, the remote monitoring and management platform. The record says versions before 2025.4 are vulnerable. Upgrade to 2025.4 or later and confirm the details in the N-able advisory.
What's affected
The record's description is short: N-central before 2025.4 is vulnerable to authentication bypass via path traversal. The weakness type is CWE-22 (improper limitation of a pathname to a restricted directory). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means network reachable, low complexity, no privileges and no user interaction needed, with high impact on confidentiality, integrity and availability.
The record does not list other fixed versions, hotfix names or workarounds. The vendor advisory page did not render for me outside a browser, so I have not confirmed anything beyond the record. Read the advisory before you act, especially if you run an on premises server on an older branch.
N-central manages many endpoints, so a bypass on the server is worth more to an attacker than a flaw on a single machine. That is why the score is at the top of the scale.
How to check if you're exposed
Sign in to your N-central server and check the product version in the administration area or the about page. Compare it with 2025.4. Anything lower is in the range named in the record.
If you use N-able's hosted service, ask N-able how your tenant is handled. If you run the server yourself, check whether the web interface is reachable from the internet. A public interface raises the urgency.
Look at web server access logs for requests with unusual path sequences aimed at the N-central web interface. Keep the logs for any later investigation.
What to do now
- Find every N-central server you operate and read its version.
- Upgrade to 2025.4 or later by following the N-able advisory and release notes.
- Until you upgrade, restrict access to the web interface to trusted networks or a VPN.
- Review administrator accounts, API tokens and recent configuration changes for anything you do not recognize.
- Keep logs from before and after the upgrade in case you need to investigate.
Why it matters
Path traversal happens when an application builds a file path from input and fails to keep it inside the intended directory. In an authentication flow, that mistake can let a request reach resources or logic that should only be available after login.
Management platforms are attractive targets. Whoever controls them can often push software or scripts to the machines they manage. The record does not list this CVE in the CISA KEV catalog, and I have no source that says it is exploited. Patch on the strength of the severity and exposure, and recheck KEV if your risk process depends on it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2025-11366 exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability and I found no advisory saying so. The advisory on the vendor site is the place to check for changes.
What version fixes it?
The record says versions before 2025.4 are vulnerable, which points to 2025.4 as the first fixed release. Confirm that in the N-able advisory.
Sources
- N-able security advisory for CVE-2025-11366 (vendor page, which loads dynamically, so read it in a browser)
- NVD record for CVE-2025-11366 (description, CVSS vector, CWE)
You can also run the free in-browser dependency scan against your own application dependencies while you work through vendor patches.
Last reviewed: 19 October 2026.
