N-able ships N-central emergency fix after 33 exploits published
Hosted N-central was taken offline worldwide, and on-premises customers were told to shut servers down until 2026.4 HF2.
82
Vulnerability1 · 1 read
CVE-2026-125883
XXE schema poisoning in N-able N-central before 26.4.1
- CVSS 4.0
- 9.3 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
N-able N-central improperly restricts XML external entity references, enabling XML schema poisoning. Anyone who can reach the product over the network can trigger it without authentication or user interaction, with high impact on confidentiality and integrity and low impact on availability. Versions before 26.4.1 are affected. Published exploits preceded the emergency fix.
What to do: Upgrade N-central to 26.4.1.
| Product | Affected | Fixed in |
|---|---|---|
| N-able N-central | before 26.4.1 | 26.4.1 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1.
- Weakness
- CWE-611
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X