CVE-2026-125881: 
N-central Analyse et atténuation de la vulnérabilité

CVE-2026-125881 is a Server-Side Request Forgery (SSRF) vulnerability in N-able N-central that allows unauthenticated remote attackers to initiate unauthorized server-side HTTP requests. It affects all versions of N-central before 26.4.1 and was disclosed on November 10, 2026. The vulnerability carries a CVSS v4.0 base score of 9.3 (Critical), reflecting its network-exploitable, no-authentication-required nature (GitHub Advisory).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and is specifically identified as a "SchemaHint SSRF via service import schema validation" — meaning the flaw resides in the schema validation logic used during service import operations in N-central (N-able Advisory). An attacker can supply a crafted schema or URL hint to the vulnerable endpoint, causing the N-central server to fetch arbitrary URLs on the attacker's behalf without authentication. No special privileges or user interaction are required, and attack complexity is low, making this straightforward to exploit over the network (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to make the N-central server perform arbitrary HTTP requests to internal systems and external targets, potentially exposing internal services that are otherwise inaccessible from the internet. This can lead to exfiltration of sensitive data from backend systems, interaction with internal APIs or cloud metadata endpoints, and high-integrity impact on the vulnerable system. Given that N-central is an IT management platform with broad network access to managed endpoints, the blast radius of exploitation could extend to the entire managed infrastructure (GitHub Advisory, N-able Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (GitHub Advisory). However, the vulnerability was disclosed alongside a broader batch of 33 N-central vulnerabilities, prompting N-able to take its cloud service offline as an emergency measure (CSOOnline, CyberDaily). The EPSS score is 0.0 at time of publication, and the CVE is not currently listed in the CISA KEV catalog. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing N-able N-central instances running versions prior to 26.4.1 using tools like Shodan or Censys, searching for N-central web interfaces.
2. Identify vulnerable endpoint: Target the service import schema validation functionality, which is the specific feature identified in the advisory as the SSRF entry point ("SchemaHint SSRF via service import schema validation").
3. Craft malicious request: Submit a crafted HTTP request to the schema validation endpoint containing a URL or schema hint pointing to an internal target (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or internal RFC-1918 addresses).
4. Trigger server-side fetch: The N-central server processes the schema hint and performs an outbound HTTP request to the attacker-specified URL without authentication checks.
5. Collect response data: Capture the server's response, which may contain internal service data, credentials, cloud metadata tokens, or other sensitive information accessible from the N-central server's network position (N-able Advisory, GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS connections from the N-central server to internal RFC-1918 addresses or cloud metadata endpoints (e.g., 169.254.169.254); outbound requests to unusual external IPs or domains originating from the N-central process.
• Logs: N-central application logs showing repeated or anomalous requests to the service import schema validation endpoint with external or internal URLs as parameters; HTTP requests to the schema endpoint from unexpected source IPs.
• Web Server Logs: Access log entries targeting the schema validation/service import endpoint with URL-like values in request parameters, particularly from unauthenticated sessions.

N-able has released a patch in N-central version 26.4.1 (delivered as HF2), and all users should upgrade immediately (N-able Release Notes). N-able also took its hosted cloud service offline as an emergency measure and advised on-premises customers to do the same until patched (CyberDaily). If immediate patching is not possible, implement network segmentation to restrict the N-central server's outbound HTTP/HTTPS access to only necessary and explicitly approved destinations, and monitor all outbound connections from the N-central server for anomalous activity.

The disclosure of CVE-2026-125881 was part of a larger batch of 33 N-central vulnerabilities published simultaneously, which prompted significant industry attention. N-able took the unusual step of taking its cloud service offline as an emergency response and urged on-premises customers to follow suit (CyberDaily). Tenable published an FAQ blog post titled "Able2Shell" addressing the reported N-central zero-day vulnerabilities, reflecting the severity of the collective disclosure (Tenable Blog). CSOOnline reported on the emergency fix issued two days after the 33 exploits were published, highlighting the urgency of the situation (CSOOnline).