CVE-2026-125882: 
N-central Analyse et atténuation de la vulnérabilité

CVE-2026-125882 is a relative path traversal vulnerability in N-able N-central that allows authenticated attackers with high privileges to traverse the file system and access files outside of intended application directories. The vulnerability affects all versions of N-central before 26.4.1 and was published on November 10, 2026. It is classified as High severity with a CVSS v4.0 base score of 8.6, requiring network access, low complexity, and high privileges with no user interaction needed (GitHub Advisory, N-able Advisory).

The vulnerability is classified as CWE-23 (Relative Path Traversal), where the application fails to properly neutralize relative path sequences (e.g., ../) in user-supplied input used to construct file system paths (GitHub Advisory). The attack vector is network-based and targets the file repository upload functionality, as indicated by the advisory title referencing "RCE via File Repository Upload Path Traversal" (N-able Advisory). Exploitation requires high-privilege credentials (e.g., an authenticated administrator account), and no additional attack requirements or user interaction are needed. The vulnerability is associated with CAPEC-139 (Relative Path Traversal) and CAPEC-76 (Manipulating Web Input to File System Calls).

Successful exploitation allows an attacker to read sensitive files stored on the N-central server outside of intended application directories, resulting in high confidentiality and integrity impact to the vulnerable system, with low availability impact (GitHub Advisory). Given that N-central is an IT management and remote monitoring platform used by managed service providers (MSPs), exposure of sensitive configuration files, credentials, or managed endpoint data could facilitate lateral movement across managed customer environments. The advisory title also references potential remote code execution (RCE) via the file repository upload path traversal, suggesting the impact may extend beyond file disclosure (N-able Advisory).

As of the time of disclosure, there is no public proof-of-concept (PoC) exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the broader disclosure context — N-able N-central was reported to have 33 vulnerabilities published simultaneously, prompting N-able to take its cloud service offline — suggests elevated risk and attacker interest in this product (CSO Online, CyberDaily).

1. Reconnaissance: Identify internet-facing N-able N-central instances running versions prior to 26.4.1 using network scanning tools or Shodan/Censys queries targeting N-central login portals.
2. Authentication: Obtain high-privilege credentials for the N-central instance (e.g., through credential stuffing, phishing, or reuse of compromised MSP credentials).
3. Identify vulnerable endpoint: Locate the file repository upload functionality within the N-central web interface, which is the reported attack surface for this path traversal.
4. Craft malicious path payload: Construct a file path input containing relative traversal sequences (e.g., ../../etc/passwd or ../../conf/application.properties) to escape the intended upload directory.
5. Submit traversal request: Submit the crafted request via the file upload or file access endpoint, causing the server to resolve the relative path outside the restricted directory.
6. Retrieve sensitive files: Access or exfiltrate sensitive files such as configuration files, credentials, or private keys stored on the N-central server, potentially enabling further compromise or RCE (N-able Advisory, GitHub Advisory).

• Network: Unusual HTTP requests to N-central file repository upload endpoints containing encoded path traversal sequences (e.g., ../, %2e%2e%2f, ..%2f) in file path parameters; unexpected outbound connections from the N-central server to unknown external IPs.
• Logs: N-central application or web server access logs showing requests with path traversal patterns in file name or path fields; repeated access attempts to sensitive system paths (e.g., /etc/, /conf/, /var/) from authenticated sessions.
• File System: Unexpected access or modification timestamps on sensitive files outside the N-central application directory; new or modified files in upload directories that do not correspond to legitimate uploads.
• Process: Unusual child processes spawned by the N-central application process, particularly shell processes or file read utilities, which may indicate escalation from path traversal to RCE (N-able Advisory).

N-able has released a patch in N-central version 26.4.1 (delivered as HF2), and all users should upgrade immediately (N-able Status). N-able also took its hosted cloud service offline in response to the broader vulnerability disclosure and advised on-premises customers to follow suit until patched (CyberDaily). As interim mitigations: implement strict input validation and path canonicalization on file path inputs; restrict file system access permissions for the N-central application process to only necessary directories; and deploy network segmentation to limit access to the N-central management interface from untrusted networks.

The disclosure of CVE-2026-125882 occurred as part of a mass vulnerability disclosure affecting N-able N-central, with reports indicating 33 vulnerabilities were published simultaneously, prompting N-able to issue an emergency hotfix and take its cloud service offline (CSO Online, CyberDaily). Tenable published a FAQ blog post titled "Able2Shell" addressing the reported N-central zero-day vulnerabilities, reflecting significant industry attention (Tenable Blog). Security news outlets including SecurityOnline and CTI Pilot covered the event, highlighting the urgency for MSPs relying on N-central to patch immediately (SecurityOnline, CTI Pilot).