N-able N-central: Server-Side Request Forgery (SSRF)
Summary
N-able N-central, a remote monitoring and management (RMM) platform, contains a Server-Side Request Forgery (SSRF) vulnerability in its service import schema validation. According to the CVSS vector, an attacker on the network can trigger it without credentials or user interaction, which may allow the server to send requests to internal or other unintended targets. N-able rates the issue Critical (CVSS 4.0 base score 9.3), and the impact on confidentiality and integrity is rated High.
Affected
- N-central before 26.4.1 (per the CVE record and aggregators)
- The default configuration is reported as unaffected.
Fixed in
- Version 26.4.1 according to the CVE record and aggregators.
- N-able release notes list this CVE in the hotfix "N-central 2026.4 HF2". The exact build number and upgrade path for HF2 are not confirmed.
Workaround
Unknown. No SSRF-specific workaround is documented in the sources reviewed.
Exploitation
- N-able reports no active exploitation of the batch of vulnerabilities it published, as of its status page.
- A public proof-of-concept repository (Able2Shell) exists for the batch. It is not confirmed that it covers this CVE.
- Exploitation of CVE-2026-125881 in the wild is not confirmed.
Our recommendation
- Identify all on-premises N-central servers and any MSP-hosted instances you rely on, and confirm their build versions.
- Apply the vendor fix as soon as the build is confirmed. Check the vendor advisory for the exact version and upgrade path.
- Until patched, restrict access to the N-central web interface and check whether the server is reachable from the internet.
- Review logs for unusual outbound requests from the N-central server since 8 November 2026.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- N-able security advisory CVE-2026-125881 me.n-able.com
- N-central 2026.4 HF2 release notes status.n-able.com
- CSO Online: N-central gets emergency fix www.csoonline.com
- Strix AI: CVE-2026-125881 www.strix.ai
- BleepingComputer: N-able takes cloud platform offline after zero-days published www.bleepingcomputer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:36.
Original description (NVD)
Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue affects N-central: before 26.4.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.