N-able N-central before 2026.4.1.26 exploited in the wild
Original title: N-able security advisory (AV26-1143)
Open-source reporting says CVE-2026-125883 is being exploited; the Cyber Centre urges applying N-central updates.
Canada's Cyber Centre issued advisory AV26-1143 on November 12, 2026, stating that as of November 10 N-able N-central before 2026.4.1.26 is affected by vulnerabilities. Open-source reporting indicates CVE-2026-125883 is exploited in the wild. The centre tells users and administrators to review N-able's 2026.4 HF2 release notes and status page and apply necessary updates.
Unconfirmed: In-the-wild exploitation of CVE-2026-125883 is attributed to open-source reporting, not confirmed in the advisory itself.
- Advisory serial number is AV26-1143, dated November 12, 2026.
- Affected product is N-central prior to 2026.4.1.26.
- Only CVE-2026-125883 is named, via open-source exploitation reporting.
- N-able links cited are the 2026.4 HF2 release notes and the status page.
| Product | Affected | Fixed in |
|---|---|---|
| N-able N-central | Prior to 2026.4.1.26 | 2026.4.1.26 |
- 1.Review N-able's 2026.4 HF2 release notes and status page and apply available N-central updates.
- CVEs
- CVE-2026-125883
- Vendors
- N-able
- Products
- N-central
- Organizations
- Canadian Centre for Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125883 | XXE schema poisoning in N-able N-central before 26.4.1 | 9.3 | — |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1143 Date: November 12, 2026 As of November 10, 2026, N-able is affected by vulnerabilities in the following product: N-central Prior to 2026. 4. 1.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.