Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

N-able N-central before 26.4.1 allows XML data poisoning

CVE-2026-125883 · published 3 days ago
Summary

The N-central management system versions earlier than 26.4.1 can be tricked into reading malicious data from external sources when processing XML files. This could let an attacker insert harmful content or steal information stored by the system. Upgrade to version 26.4.1 or later to close the risk.

What to do
  • Update n-able n-central to version 26.4.1 or later.
Affected software
VendorProductAffected versions
n-able n-central < 26.4.1
Original advisory text
Multiple XXE Vulnerabilities
Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning.

This issue affects N-central: before 26.4.1.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-611XML External Entity (XXE)
Timeline
Published10 Nov 2026
Updated13 Nov 2026
First seen10 Nov 2026
Sources
CVE-2026-125883 · NVD
CVE-2026-125883 · MITRE
Track software like this
Free during beta