CVE-2025-11700
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
N-central versions prior to 2025.4 are vulnerable to multiple XML External Entity (XXE) injection attacks leading to information disclosure. The vulnerability stems from improper handling of external XML entities.
Risk Assessment
An attacker could exploit this vulnerability to read sensitive files or data from the N-central server, potentially leading to information leakage. Organizations using N-central versions below 2025.4 are at risk.
Recommendation
Update N-central to version 2025.4 or later. Check for any unauthorized data access.
Other vulnerabilities in N-central
See all- CVE-2026-86218CriticalActively exploited
N-central is vulnerable to pre-auth remote code execution. This issue affects N-central before version 2026.3.1.14.
- CVE-2026-18577HighActively exploited
An incomplete patch for CVE-2026-18556 allows authentication bypass and account takeover in N-central versions up to 2026.3.1.
- CVE-2025-11366Critical
N-central before 2025.4 is vulnerable to authentication bypass via path traversal.
- CVE-2026-86206Medium
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4.
- CVE-2026-86207High
An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs.
Original NVD description (English source)
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
Vulnerability data from NVD (NIST) · CISA KEV · EPSS