CVE-2026-125881
CriticalCVSS 9.3Summary
N-able N-central before version 26.4.1 contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to force server-side requests. The issue affects versions prior to 26.4.1.
Risk Assessment
An attacker could use the server to send requests to internal resources, potentially exposing information or reaching services not accessible externally. This may enable further attack escalation within the internal network.
Recommendation
Update N-able N-central to version 26.4.1 or later. Restrict outbound requests from the server to only necessary resources.
Other vulnerabilities in N-able N-central
See all- CVE-2026-91000High
A missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central before 2026.4.1.
- CVE-2026-125958High
A download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central through 24.6.1.
- CVE-2026-125882High
N-able N-central contains a relative path traversal vulnerability that allows an attacker to manipulate file access paths. This issue affects N-central versions before 26.4.1.
- CVE-2026-125880High
N-able N-central contains a Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of HTTP headers for scripting syntax. This issue affects N-central versions before 26.4.1.
- CVE-2026-125879High
N-able N-central contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects N-central versions before 26.4.1.
- CVE-2026-125878High
N-able N-central contains a cross-site scripting vulnerability caused by improper neutralization of input during web page generation, allowing resource injection. This issue affects N-central versions before 26.4.1.
- CVE-2026-125883Critical
N-able N-central before version 26.4.1 is vulnerable to improper restriction of XML external entity references, allowing XML Schema Poisoning. The issue affects versions prior to 26.4.1.
- CVE-2026-18556HighActively exploited
Authentication bypass using an alternate path or channel vulnerability in N-able N-central through version 2026.1 allows authentication bypass.
- CVE-2025-8876HighActively exploited
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection. This issue affects N-central before 2025.3.1.
- CVE-2025-8875HighActively exploited
Deserialization of untrusted data vulnerability in N-able N-central allows local code execution. Affects versions before 2025.3.1.
Original NVD description (English source)
Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue affects N-central: before 26.4.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS