{"vulnerability": "CVE-2025-11700", "sightings": [{"uuid": "b0602aab-b71e-4067-93c2-23d3d8ea453b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11700", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m5z5n7an7v2j", "content": "", "creation_timestamp": "2025-11-19T21:02:37.719321Z"}, {"uuid": "b5d008f2-b0dc-489e-bc31-2e4c7166fcff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11700", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-11700.yaml", "content": "", "creation_timestamp": "2025-11-18T19:07:35.000000Z"}, {"uuid": "15db012d-6782-4ada-a78e-c7e4a09ff46d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11700", "type": "seen", "source": "https://bsky.app/profile/leakix.bsky.social/post/3m62zwxuxry2w", "content": "", "creation_timestamp": "2025-11-20T15:01:49.011931Z"}, {"uuid": "adbac6cd-acb7-4007-b46e-90586f77e717", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11700", "type": "seen", "source": "https://mastodon.social/users/leakix/statuses/115582625945452576", "content": "", "creation_timestamp": "2025-11-20T15:01:50.806533Z"}, {"uuid": "e028d228-572f-42be-84f8-58895f784548", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11700", "type": "seen", "source": "https://www.acn.gov.it/portale/w/n-able-disponibile-poc-per-lo-sfruttamento-delle-cve-2025-9316-e-cve-2025-11700", "content": "", "creation_timestamp": "2025-11-20T13:07:24.000000Z"}, {"uuid": "08d35e4a-23d5-48a8-96c7-f00d8b41ccfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11700", "type": "seen", "source": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m5hgvua4rxc2", "content": "", "creation_timestamp": "2025-11-12T20:01:55.744436Z"}, {"uuid": "0e260bd8-ef34-494d-abab-3e1a930d2dd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11700", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m5hjwsts5h2k", "content": "", "creation_timestamp": "2025-11-12T20:54:48.344974Z"}, {"uuid": "8e5dfc60-26b0-4a01-924d-283e79cd53e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11700", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m7sye2ne6s2f", "content": "", "creation_timestamp": "2025-12-12T21:02:26.402420Z"}, {"uuid": "7bc27f9c-197b-46ce-a96a-ae0a5db50b84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11700", "type": "seen", "source": "https://gist.github.com/Darkcrai86/c85090efcea5f12a4299f70e97f9c884", "content": "", "creation_timestamp": "2025-12-20T11:18:25.000000Z"}, {"uuid": "c1ba1691-3989-434b-9041-2c2d345f8dbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11700", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Zach Hanley (Horizon3.ai)\", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module scans for vulnerable N-able N-Central instances affected by\\n          CVE-2025-9316 (Unauthenticated Session Bypass) and CVE-2025-11700 (XXE).\\n\\n          The module attempts to exploit CVE-2025-9316 by sending a sessionHello SOAP\\n          request to the ServerMMS endpoint with various appliance IDs to obtain an\\n          unauthenticated session. If successful, it then tests for CVE-2025-11700\\n          by writing an XXE payload file and triggering it via importServiceTemplateFromFile.\\n\\n          Files of interest that can be read via XXE:\\n          - /opt/nable/var/ncsai/etc/ncbackup.conf\\n          - /var/opt/n-central/tmp/ncbackup/ncbackup.bin (PostgreSQL dump)\\n          - /opt/nable/etc/keystore.bcfks (encrypted keystore)\\n          - /opt/nable/etc/masterPassword (keystore password)\\n\\n          Affected versions: N-Central < 2025.4.0.9\", \"disclosure_date\": \"2025-11-17\", \"fullname\": \"auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"N-able N-Central Authentication Bypass and XXE Scanner\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/nable_ncentral_auth_bypass_xxe\", \"references\": [\"CVE-2025-9316\", \"CVE-2025-11700\", \"URL-https://horizon3.ai/attack-research/attack-blogs/n-able-n-central-from-n-days-to-0-days/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:37.858651Z"}]}