N-able N-central: Cross-Site Scripting (OGNL injection) in the web interface
Summary
N-able N-central, a remote monitoring and management platform used by managed service providers, contains multiple injection vulnerabilities before version 26.4.1. The CNA record classifies the issue as Cross-Site Scripting (CWE-79) with CVSS 4.0 8.7, while the advisory title describes OGNL injection leading to remote code execution; VulDB rates it 3.5, and the classification is not yet confirmed. Depending on the confirmed attack path, an attacker with low privileges could read or change data on the server and reach the customer endpoints it manages. Public proof-of-concept code exists, and N-able reports no observed active exploitation, while other reports describe exploitation attempts.
Affected
- N-able N-central from 0 to before 26.4.1 (CNA record)
- VulDB lists up to 26.4.0
Fixed in
- 26.4.1 according to the CVE record
- N-central 2026.4 HF2 according to the N-able release notes; equivalence to 26.4.1 not confirmed
- A follow-up hotfix is announced but not yet released
Workaround
- Unknown. The vendor's main guidance is to upgrade; N-central servers should remain offline until the upgrade has succeeded. N-able has taken hosted instances offline.
Exploitation
- Public proof-of-concept code exists (researcher repository; mapping to this CVE not confirmed by a primary source).
- Active exploitation: disputed. N-able reports no observed active exploitation; other reports describe exploitation attempts against the platform that are not attributed to this CVE.
- Censys counted 1728 internet-exposed N-central instances worldwide; no Swiss figure was found.
Our recommendation
- Check whether any N-central server is reachable from the internet and restrict access immediately.
- Verify the build version; any version before the fixed build is affected.
- Upgrade to the fixed build as soon as possible and install the follow-up hotfix when released; confirm the exact build with N-able first.
- Review administrator accounts, recent logins and newly created accounts on N-central servers.
- Monitor the N-able advisory and status page for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- N-able security advisory CVE-2026-125878 me.n-able.com
- N-central 2026.4 HF2 release notes (N-able) status.n-able.com
- CVE record summary (threatint) cve.threatint.com
- VulDB entry 435029 vuldb.com
- CSO Online: N-central emergency fix www.csoonline.com
- The Hacker News: N-able takes hosted N-central offline thehackernews.com
- OffSeq radar entry CVE-2026-125878 radar.offseq.com
- N-able status page (pulsapi) www.pulsapi.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:56.
Original description (NVD)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.