N-able N-central: XML External Entity (XXE) injection

Summary

N-able N-central, a remote monitoring and management (RMM) platform used by managed service providers, contains an XML External Entity (XXE) vulnerability that can be triggered without authentication over the network. An attacker can abuse it to poison the XML schema and potentially reach data or run commands with the service account's privileges. Public exploit code for an XXE chain was published on 9 November 2026, and the vendor has released a fix.

Affected

• N-central before 26.4.1 according to the CNA record (default: unaffected)
• Version naming conflict: the vendor release notes list this CVE as fixed in N-central 2026.4 Hotfix 2, build 2026.4.1.26. Confirm the exact version against the vendor advisory.

Fixed in

• N-central 2026.4 Hotfix 2, build 2026.4.1.26 (per vendor release notes; confirm against the advisory)
• Earlier versions must first be upgraded to a supported version (2026.1, 2026.2, 2026.3, 2026.3.1 hotfixes or 2026.4 builds).
• Agents and probes must also be upgraded to restore compatibility.
• Note: patched servers may not show a new version number, so verify against vendor guidance.

Workaround

Unknown. The vendor has not listed a mitigation specific to this CVE. Since a patch is available, patching is the required measure. During the initial incident, N-able took hosted N-central offline and advised on-premises customers to shut down their servers until the fix was released. Whether this still applies is unknown; check the vendor's current status.

Exploitation

• Public proof-of-concept: yes. A researcher published 33 vulnerabilities and four exploit chains on 9 November 2026, including an anonymous XXE chain.
• Reported to require no authentication and to allow command execution as the service account, in some cases with root access.
• In the wild: the vendor reports scanning activity linked to the published exploits but no confirmed successful exploitation of customer environments. OffSeq lists the CVE as not known to be exploited.
• The product was targeted in August 2026 via a different CVE (CVE-2026-18577).

Our recommendation

• Patch N-central to the fixed build immediately and upgrade all agents and probes.
• Check whether N-central is in use and where, and whether any instance is reachable from the internet; treat exposed or unpatched servers as high priority.
• Ask your managed service provider whether N-central is patched.
• Review authentication and admin-access logs for unexpected activity, especially since August 2026. Treat unpatched or exposed servers as potentially compromised until verified.
• Note that a compromise may enable lateral movement to managed endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• N-able security advisory CVE-2026-125883 me.n-able.com
• N-central 2026.4 Hotfix 2 release notes status.n-able.com
• CSO Online: N-central emergency fix www.csoonline.com
• Huntress: N-able vulnerability exploitation www.huntress.com
• OffSeq Radar: CVE-2026-125883 radar.offseq.com
• Strix: CVE-2026-125883 www.strix.ai
• Ostorlab: N-central RCE, 33 zero-days blog.ostorlab.co
• N-able blog: N-central security update August 2026 www.n-able.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:35.