VulnerabilityDeferred
CVE-2025-9316
N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.
MEDIUM 6.9EPSS 37.4%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 37.4%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.
- CVSS 4.0
- 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 37.39% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-1284
- Source
- a5532a13-c4dd-4202-bef1-e0b8f2f8d12b
EPSS moved from 37.4% on 13 October 2026 to 37.4% on 31 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.