{"metadata": {"vulnerability": "CVE-2025-9316", "count": 39, "kinds": {"milestone": 4, "sighting": 15, "kev": 11, "other": 9}}, "data": [{"timestamp": "2025-08-21T11:21:33.194Z", "date_only": false, "value": "2025-08-21T11:21:33.194Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-9316", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-11-12T15:24:00Z", "date_only": false, "value": "2025-11-12T15:24:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / N-able", "record": "CVE-2025-9316", "field": "containers.cna.datePublic"}, {"timestamp": "2025-11-12T15:27:25.206Z", "date_only": false, "value": "2025-11-12T15:27:25.206Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-9316", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-11-12T15:27:25.206Z", "date_only": false, "value": "2025-11-12T15:27:25.206Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / N-able", "record": "CVE-2025-9316", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-11-12T16:15:37Z", "date_only": false, "value": "2025-11-12T16:15:37Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9VWR-G237-H5C9", "record": "GHSA-9VWR-G237-H5C9", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-11-12T16:15:37.623Z", "date_only": false, "value": "2025-11-12T16:15:37.623", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-9316", "record": "FKIE_CVE-2025-9316", "field": "published"}, {"timestamp": "2025-11-12T18:26:39.769Z", "date_only": false, "value": "2025-11-12T18:26:39.769142Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-9316", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-11-12T18:26:39.769Z", "date_only": false, "value": "2025-11-12T18:26:39.769142Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-9316", "record": "FKIE_CVE-2025-9316", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-11-12T18:26:46.799Z", "date_only": false, "value": "2025-11-12T18:26:46.799Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-9316", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-11-12T18:26:46.799Z", "date_only": false, "value": "2025-11-12T18:26:46.799Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-9316", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-11-12T18:31:25Z", "date_only": false, "value": "2025-11-12T18:31:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9VWR-G237-H5C9", "record": "GHSA-9VWR-G237-H5C9", "field": "published"}, {"timestamp": "2025-11-12T18:31:25Z", "date_only": false, "value": "2025-11-12T18:31:25Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9VWR-G237-H5C9", "record": "GHSA-9VWR-G237-H5C9", "field": "modified"}, {"timestamp": "2025-11-18T18:14:32Z", "date_only": false, "value": "2025-11-18T18:14:32.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-9316.yaml", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "b6f603d4-3d03-4c13-a283-eb451c27b47b", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-9316.yaml"}, {"timestamp": "2025-11-20T13:07:24Z", "date_only": false, "value": "2025-11-20T13:07:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/n-able-disponibile-poc-per-lo-sfruttamento-delle-cve-2025-9316-e-cve-2025-11700", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "ce0a639d-9187-49ea-962c-dc516f667c8e", "url": "https://www.acn.gov.it/portale/w/n-able-disponibile-poc-per-lo-sfruttamento-delle-cve-2025-9316-e-cve-2025-11700"}, {"timestamp": "2025-11-20T15:01:48.917Z", "date_only": false, "value": "2025-11-20T15:01:48.917167Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/leakix.bsky.social/post/3m62zwxuxry2w", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "79d796ae-9175-455b-978a-4d2114de2051", "url": "https://bsky.app/profile/leakix.bsky.social/post/3m62zwxuxry2w"}, {"timestamp": "2025-11-20T15:01:50.712Z", "date_only": false, "value": "2025-11-20T15:01:50.712235Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/leakix/statuses/115582625945452576", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "09a29ad5-9c84-4f24-b5e5-4559689549cc", "url": "https://mastodon.social/users/leakix/statuses/115582625945452576"}, {"timestamp": "2025-11-21T21:02:55.961Z", "date_only": false, "value": "2025-11-21T21:02:55.961626Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m666lcb6ls2b", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "3c45333c-17cc-44b5-b1bb-dd4549c7115f", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m666lcb6ls2b"}, {"timestamp": "2025-12-12T21:02:30.845Z", "date_only": false, "value": "2025-12-12T21:02:30.845018Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m7sye3afld2b", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "30aad040-801b-4464-abfd-e601df8bae98", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m7sye3afld2b"}, {"timestamp": "2025-12-20T11:18:25Z", "date_only": false, "value": "2025-12-20T11:18:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Darkcrai86/c85090efcea5f12a4299f70e97f9c884", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "cfbde16d-3a0a-40b2-a37f-b7bb53f6eb16", "url": "https://gist.github.com/Darkcrai86/c85090efcea5f12a4299f70e97f9c884"}, {"timestamp": "2026-01-18T04:40:32Z", "date_only": false, "value": "2026-01-18T04:40:32+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2025-9316", "field": "timestamps.asserted_at", "uuid": "928dc602-8da5-4f9f-a996-376bb7a3552e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-01-18T04:40:32Z", "date_only": false, "value": "2026-01-18T04:40:32+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-9316", "field": "timestamps.first_seen_at", "uuid": "928dc602-8da5-4f9f-a996-376bb7a3552e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-03T00:00:00Z", "date_only": false, "value": "2026-06-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-9316", "field": "timestamps.asserted_at", "uuid": "c19bb73c-eed8-40db-83e1-8e290864eb02", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-03T00:00:00Z", "date_only": false, "value": "2026-06-03T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-9316", "field": "evidence.0.details.added_date", "uuid": "c19bb73c-eed8-40db-83e1-8e290864eb02", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-03T00:00:00Z", "date_only": false, "value": "2026-06-03T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-03)", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "bbe86a01-7b32-4422-9ebe-88060486ff6e"}, {"timestamp": "2026-06-03T00:00:00Z", "date_only": false, "value": "2026-06-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-9316", "field": "timestamps.first_seen_at", "uuid": "c19bb73c-eed8-40db-83e1-8e290864eb02", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-03T00:00:00Z", "date_only": false, "value": "2026-06-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-9316", "field": "status.status_updated_at", "uuid": "c19bb73c-eed8-40db-83e1-8e290864eb02", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-17T10:08:44.600Z", "date_only": false, "value": "2026-06-17T10:08:44.600", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-9316", "record": "FKIE_CVE-2025-9316", "field": "lastModified"}, {"timestamp": "2026-06-19T12:45:10.946Z", "date_only": false, "value": "2026-06-19T12:45:10.946156Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/78b053e2-16df-4d30-a9bb-4ad52a66c64c", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "c5686854-1226-4aaa-b515-6b58e97554b4", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/78b053e2-16df-4d30-a9bb-4ad52a66c64c"}, {"timestamp": "2026-06-23T00:00:00Z", "date_only": false, "value": "2026-06-23T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-23)", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "35c79b60-1671-4887-a44a-31b7da973d10"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-9316", "field": "timestamps.recorded_at", "uuid": "c19bb73c-eed8-40db-83e1-8e290864eb02", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:03:01.907Z", "date_only": false, "value": "2026-06-23T14:03:01.907729Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c19bb73c-eed8-40db-83e1-8e290864eb02", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "1fdacbc8-2e46-4881-b2e4-63d782785c5f", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c19bb73c-eed8-40db-83e1-8e290864eb02"}, {"timestamp": "2026-06-30T09:23:45.426Z", "date_only": false, "value": "2026-06-30T09:23:45.426546Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/928dc602-8da5-4f9f-a996-376bb7a3552e", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "a68f3c4d-96b1-46cd-a2f6-c0796f9a2085", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/928dc602-8da5-4f9f-a996-376bb7a3552e"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2025-9316", "field": "timestamps.last_seen_at", "uuid": "928dc602-8da5-4f9f-a996-376bb7a3552e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": true, "value": "2026-07-20", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2025-9316", "field": "evidence.0.details.observation_date", "uuid": "928dc602-8da5-4f9f-a996-376bb7a3552e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2025-9316", "field": "status.status_updated_at", "uuid": "928dc602-8da5-4f9f-a996-376bb7a3552e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-22T01:00:01Z", "date_only": false, "value": "2026-07-22T01:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2025-9316", "field": "timestamps.recorded_at", "uuid": "928dc602-8da5-4f9f-a996-376bb7a3552e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-08T06:47:37.953Z", "date_only": false, "value": "2026-09-08T06:47:37.953066Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "fd5fa95e-8044-47ac-aeef-5cd2a80aaed2", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Zach Hanley (Horizon3.ai)\", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module scans for vulnerable N-able N-Central instances affected by\\n          CVE-2025-9316 (Unauthenticated Session Bypass) and CVE-2025-11700 (XXE).\\n\\n          The module attempts to exploit CVE-2025-9316 by sending a sessionHello SOAP\\n          request to the ServerMMS endpoint with various appliance IDs to obtain an\\n          unauthenticated session. If successful, it then tests for CVE-2025-11700\\n          by writing an XXE payload file and triggering it via importServiceTemplateFromFile.\\n\\n          Files of interest that can be read via XXE:\\n          - /opt/nable/var/ncsai/etc/ncbackup.conf\\n          - /var/opt/n-central/tmp/ncbackup/ncbackup.bin (PostgreSQL dump)\\n          - /opt/nable/etc/keystore.bcfks (encrypted keystore)\\n          - /opt/nable/etc/masterPassword (keystore password)\\n\\n          Affected versions: N-Central < 2025.4.0.9\", \"disclosure_date\": \"2025-11-17\", \"fullname\": \"auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"N-able N-Central Authentication Bypass and XXE Scanner\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/nable_ncentral_auth_bypass_xxe\", \"references\": [\"CVE-2025-9316\", \"CVE-2025-11700\", \"URL-https://horizon3.ai/attack-research/attack-blogs/n-able-n-central-from-n-days-to-0-days/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb"}, {"timestamp": "2026-09-17T10:15:12.041Z", "date_only": false, "value": "2026-09-17T10:15:12.041926Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-16)", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "ad1eaaa6-a536-4c3c-85fa-6001e4061583"}, {"timestamp": "2026-10-03T00:00:00Z", "date_only": false, "value": "2026-10-03T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-03)", "record": "CVE-2025-9316", "field": "creation_timestamp", "uuid": "57fea055-e1bd-47fd-a13e-2000aaa37c50"}]}