{"vulnerability": "CVE-2025-9316", "sightings": [{"uuid": "b6f603d4-3d03-4c13-a283-eb451c27b47b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-9316.yaml", "content": "", "creation_timestamp": "2025-11-18T18:14:32.000000Z"}, {"uuid": "79d796ae-9175-455b-978a-4d2114de2051", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "seen", "source": "https://bsky.app/profile/leakix.bsky.social/post/3m62zwxuxry2w", "content": "", "creation_timestamp": "2025-11-20T15:01:48.917167Z"}, {"uuid": "09a29ad5-9c84-4f24-b5e5-4559689549cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "seen", "source": "https://mastodon.social/users/leakix/statuses/115582625945452576", "content": "", "creation_timestamp": "2025-11-20T15:01:50.712235Z"}, {"uuid": "3c45333c-17cc-44b5-b1bb-dd4549c7115f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m666lcb6ls2b", "content": "", "creation_timestamp": "2025-11-21T21:02:55.961626Z"}, {"uuid": "ce0a639d-9187-49ea-962c-dc516f667c8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "seen", "source": "https://www.acn.gov.it/portale/w/n-able-disponibile-poc-per-lo-sfruttamento-delle-cve-2025-9316-e-cve-2025-11700", "content": "", "creation_timestamp": "2025-11-20T13:07:24.000000Z"}, {"uuid": "30aad040-801b-4464-abfd-e601df8bae98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m7sye3afld2b", "content": "", "creation_timestamp": "2025-12-12T21:02:30.845018Z"}, {"uuid": "cfbde16d-3a0a-40b2-a37f-b7bb53f6eb16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "seen", "source": "https://gist.github.com/Darkcrai86/c85090efcea5f12a4299f70e97f9c884", "content": "", "creation_timestamp": "2025-12-20T11:18:25.000000Z"}, {"uuid": "bbe86a01-7b32-4422-9ebe-88060486ff6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-03)", "content": "", "creation_timestamp": "2026-06-03T00:00:00.000000Z"}, {"uuid": "c5686854-1226-4aaa-b515-6b58e97554b4", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/78b053e2-16df-4d30-a9bb-4ad52a66c64c", "content": "", "creation_timestamp": "2026-06-19T12:45:10.946156Z"}, {"uuid": "1fdacbc8-2e46-4881-b2e4-63d782785c5f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c19bb73c-eed8-40db-83e1-8e290864eb02", "content": "", "creation_timestamp": "2026-06-23T14:03:01.907729Z"}, {"uuid": "35c79b60-1671-4887-a44a-31b7da973d10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-23)", "content": "", "creation_timestamp": "2026-06-23T00:00:00.000000Z"}, {"uuid": "a68f3c4d-96b1-46cd-a2f6-c0796f9a2085", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2025-9316", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/928dc602-8da5-4f9f-a996-376bb7a3552e", "content": "", "creation_timestamp": "2026-06-30T09:23:45.426546Z"}, {"uuid": "fd5fa95e-8044-47ac-aeef-5cd2a80aaed2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Zach Hanley (Horizon3.ai)\", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module scans for vulnerable N-able N-Central instances affected by\\n          CVE-2025-9316 (Unauthenticated Session Bypass) and CVE-2025-11700 (XXE).\\n\\n          The module attempts to exploit CVE-2025-9316 by sending a sessionHello SOAP\\n          request to the ServerMMS endpoint with various appliance IDs to obtain an\\n          unauthenticated session. If successful, it then tests for CVE-2025-11700\\n          by writing an XXE payload file and triggering it via importServiceTemplateFromFile.\\n\\n          Files of interest that can be read via XXE:\\n          - /opt/nable/var/ncsai/etc/ncbackup.conf\\n          - /var/opt/n-central/tmp/ncbackup/ncbackup.bin (PostgreSQL dump)\\n          - /opt/nable/etc/keystore.bcfks (encrypted keystore)\\n          - /opt/nable/etc/masterPassword (keystore password)\\n\\n          Affected versions: N-Central < 2025.4.0.9\", \"disclosure_date\": \"2025-11-17\", \"fullname\": \"auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"N-able N-Central Authentication Bypass and XXE Scanner\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/nable_ncentral_auth_bypass_xxe\", \"references\": [\"CVE-2025-9316\", \"CVE-2025-11700\", \"URL-https://horizon3.ai/attack-research/attack-blogs/n-able-n-central-from-n-days-to-0-days/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:37.953066Z"}]}