N-able N-central: Stored cross-site scripting via patch metadata

Summary

N-able N-central, a remote monitoring and management platform used by managed service providers, contains a stored Cross-Site Scripting (XSS) vulnerability (CWE-644) in its MMS3 patch metadata handling. An attacker with access to patch metadata can inject a script that runs in the browser of an administrator who opens the patch details, which can lead to session takeover or further actions in the console. The CVSS 4.0 score of 8.3 assumes high privileges and user interaction, but public research describes a pre-authentication chain that uses this XSS together with other issues from the same batch, so the real risk is likely higher. The CVE ID in the advisory URL does not match CVE-2026-125880 and needs confirmation with N-able.

Affected

• N-able N-central before 26.4.1 (CNA data: affected 0 to < 26.4.1)

Fixed in

• N-central 2026.4 Hotfix 2, build 2026.4.1.26, according to the vendor release notes (not confirmed in a vendor version matrix)
• Hotfix 1 is not a fix for this issue
• Probes, Agents and PME must also be upgraded; Agents cannot communicate with an upgraded Probe until both the Agent and PME are upgraded

Workaround

• No vendor workaround specific to this CVE is known; the fix is the upgrade
• If patching cannot happen immediately, take the on-premises server offline; N-able advised this during the response period
• Do not open patch details as an administrator until they have been checked for embedded script

Exploitation

• Public proof-of-concept exploit chains exist; the XSS is part of a publicly released set of chains that include pre-authentication paths
• Exploitation attempts against the platform have been reported, but not attributed to this CVE
• Not listed in CISA KEV according to one aggregator; the CISA catalogue was not checked directly

Our recommendation

• Upgrade on-premises N-central to 2026.4 Hotfix 2 (build 2026.4.1.26) or later as a priority, then the Probes, Agents and PME
• Check whether any on-premises N-central instance is reachable from the internet and treat such systems as urgent
• Review patch entries for script or HTML content and admin and technician account changes since November 8, 2026
• Ask your managed service provider for its N-central patch status and whether it has checked for compromise

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• N-able security advisory (CVE ID to be confirmed) me.n-able.com
• N-central 2026.4 HF2 release notes status.n-able.com
• CSO Online: N-central emergency fix and exploits www.csoonline.com
• Huntress: N-able disables cloud services www.huntress.com
• CSA research note on Able2Shell N-central zero-days labs.cloudsecurityalliance.org
• ThreatDefence: N-central Able2Shell hunting guidance threatdefence.com
• CVE-2026-125880 CNA data (threatint) cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:17.