CVE-2026-125882
HighCVSS 8.6Summary
N-able N-central contains a relative path traversal vulnerability that allows an attacker to manipulate file access paths. This issue affects N-central versions before 26.4.1.
Risk Assessment
An attacker could access files outside the intended directory, potentially leading to data disclosure or further system compromise. This impacts the confidentiality and integrity of managed resources.
Recommendation
Update N-able N-central to version 26.4.1 or later. Verify that there are no signs of unauthorized file access.
Other vulnerabilities in N-able N-central
See all- CVE-2026-91000High
A missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central before 2026.4.1.
- CVE-2026-125958High
A download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central through 24.6.1.
- CVE-2026-125880High
N-able N-central contains a Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of HTTP headers for scripting syntax. This issue affects N-central versions before 26.4.1.
- CVE-2026-125879High
N-able N-central contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects N-central versions before 26.4.1.
- CVE-2026-125878High
N-able N-central contains a cross-site scripting vulnerability caused by improper neutralization of input during web page generation, allowing resource injection. This issue affects N-central versions before 26.4.1.
- CVE-2026-125883Critical
N-able N-central before version 26.4.1 is vulnerable to improper restriction of XML external entity references, allowing XML Schema Poisoning. The issue affects versions prior to 26.4.1.
- CVE-2026-125881Critical
N-able N-central before version 26.4.1 contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to force server-side requests. The issue affects versions prior to 26.4.1.
- CVE-2026-18556HighActively exploited
Authentication bypass using an alternate path or channel vulnerability in N-able N-central through version 2026.1 allows authentication bypass.
- CVE-2025-8876HighActively exploited
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection. This issue affects N-central before 2025.3.1.
- CVE-2025-8875HighActively exploited
Deserialization of untrusted data vulnerability in N-able N-central allows local code execution. Affects versions before 2025.3.1.
Original NVD description (English source)
Relative path traversal vulnerability in N-able N-central allows Path Traversal. This issue affects N-central: before 26.4.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS