Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

N-able N-central can be tricked into internal network requests

CVE-2026-125881 · published 3 days ago
Summary

Versions of N-able N-central older than 26.4.1 let an attacker send crafted data that makes the server reach out to other systems on your network. This could expose internal services or data to an outsider. Upgrade to version 26.4.1 or later to close the issue.

What to do
  • Update n-able n-central to version 26.4.1 or later.
Affected software
VendorProductAffected versions
n-able n-central < 26.4.1
Original advisory text
Schema-hint SSRF via service import schema validation
Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery.

This issue affects N-central: before 26.4.1.
References
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published10 Nov 2026
Updated13 Nov 2026
First seen10 Nov 2026
Sources
CVE-2026-125881 · NVD
CVE-2026-125881 · MITRE
Track software like this
Free during beta