Skip to content
OpenAdvisories
High WID-SEC-2026-4440 8 CVEs

N-able N-Central: Mehrere Schwachstellen

Published Nov 9, 2026 · Updated Nov 10, 2026 · Revision 2 · de

Vendor: N-able Product: N-central Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in N-able N-Central ausnutzen, um vertrauliche Informationen offenzulegen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Administratorrechte zu erlangen oder beliebigen Code und Betriebssystembefehle mit Root- oder Nable-Rechten auszuführen.

Product

N-able N-central ist eine Remote Monitoring and Management (RMM)-Plattform für Managed Service Provider (MSPs) und IT-Abteilungen

Vulnerabilities 8

  • Critical 9.3
    CVE-2026-125881

    Schema-hint SSRF via service import schema validation

    Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue affects N-central: before 26.4.1.

    N-able N-central
  • Critical 9.3
    CVE-2026-125883

    Multiple XXE Vulnerabilities

    Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1.

    N-able N-central
  • High 8.7
    CVE-2026-125878

    Multiple OGNL Injection vulnerabilities

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1.

    N-able N-central
  • High 8.6
    CVE-2026-125879

    Local privilege escalation to root via nable-writable syslog-ng config

    Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 26.4.1.

    N-able N-central
  • High 8.6
    CVE-2026-125882

    RCE via file repository upload path traversal

    Relative path traversal vulnerability in N-able N-central allows Path Traversal. This issue affects N-central: before 26.4.1.

    N-able N-central
  • High 8.4
    CVE-2026-91000

    Insecure IPC Channels lead to local privilege escalation

    Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 2026.4.1.

    N-able N-central
  • High 8.3
    CVE-2026-125880

    Stored XSS via MMS3 patch metadata (admin context)

    Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). This issue affects N-central: before 26.4.1.

    N-able N-central
  • High 7.5
    CVE-2026-125958

    Root RCE via unsigned NSP upgrade package upload

    Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central: through 24.6.1.

    N-able N-central

Revision history

  1. #2

    N-Able Patch aufgenommen

  2. #1

    Initiale Fassung

References