N-able N-central: Relative path traversal in file repository upload

Summary

N-central, N-able's remote monitoring and management platform, contains a relative path traversal flaw (CWE-23) in its file repository upload function. An attacker with high privileges can write files outside the intended directory and, according to the vendor's advisory title, achieve remote code execution. Public proof-of-concept code exists, and the CVSS vector requires high privileges and no user interaction.

Affected

• N-able N-central before 26.4.1 (CVE record: affected 0 to < 26.4.1)
• Tested by researchers: N-central Appliance 2026.4.0.31; earlier versions are likely affected.

Fixed in

• N-central 26.4.1 according to the CVE record.
• N-able release notes name 2026.4 Hotfix 2 (HF2), build 2026.4.1.26.
• The exact version boundary has not been confirmed from the vendor advisory.

Workaround

• The vendor fix is HF2; use the workaround only for servers that cannot be patched immediately.
• Isolate the N-central server from the internet and untrusted networks as an interim measure.
• No vendor-published configuration workaround for this CVE is known.

Exploitation

• Public proof-of-concept code is available (researcher repository on GitHub, part of 33 published issues).
• As of 9 Nov 2026, N-able reported no active exploitation and no unauthorized data access.
• Scanning and honeypot activity was observed; these observations do not establish successful command execution.
• According to a secondary source, the flaw is not listed in CISA KEV as of 10 Nov 2026; this was not verified on cisa.gov.

Our recommendation

• Patch on-premises N-central to 2026.4 HF2 (build 2026.4.1.26) or later as soon as possible.
• Until patched, remove internet exposure of the N-central server.
• Check for unexpected JSP files in the web root and review access logs.
• If compromise is suspected, rotate N-central and integration credentials.
• Confirm the fixed version in the N-able advisory before writing a patch report.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• N-able security advisory CVE-2026-125882 me.n-able.com
• N-central 2026.4 HF2 release notes status.n-able.com
• Huntress: N-able disables cloud services following disclosure of Able2Shell exploit chains www.huntress.com
• CVE-2026-125882 overview cve.threatint.com
• Proof-of-concept repository (Oracle-Security) github.com
• CSO Online: N-central gets emergency fix two days after 33 exploits published www.csoonline.com
• Ostorlab: N-central RCE, 33 zero-days (Able2Shell) blog.ostorlab.co
• ThreatDefence: N-central Able2Shell response and hunting threatdefence.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:04.