CVE-2026-125883: 
N-central Analyse et atténuation de la vulnérabilité

CVE-2026-125883 is an XML External Entity (XXE) injection vulnerability in N-able N-central that allows unauthenticated remote attackers to perform XML Schema Poisoning attacks, potentially leading to arbitrary code execution or sensitive data disclosure. The vulnerability affects all versions of N-central before 26.4.1 and was published on November 10, 2026. It carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference), where the N-central application processes XML input without adequately restricting external entity references, enabling XML Schema Poisoning (CAPEC-221). An unauthenticated attacker can submit crafted XML payloads over the network — with no privileges required and no user interaction needed — causing the XML parser to resolve external entity URIs pointing to attacker-controlled resources. This can result in server-side request forgery (SSRF), local file disclosure, or remote code execution depending on the parser configuration and server environment (GitHub Advisory, Feedly).

Successful exploitation can result in high confidentiality and integrity impact on the vulnerable N-central system, with low availability impact. An unauthenticated attacker could read sensitive files from the server (including credentials, configuration data, or managed endpoint information), modify system data, or achieve arbitrary code execution — all of which are particularly severe given N-central's role as a remote monitoring and management (RMM) platform with privileged access to managed IT environments. Compromise of N-central could enable lateral movement to all managed endpoints and clients (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation (Feedly). However, reporting from CSO Online noted that N-able issued an emergency fix two days after 33 exploits were published, suggesting a broader vulnerability disclosure event involving N-central around the same timeframe (CSO Online). The EPSS score is currently 0.0, and the vulnerability has not been added to the CISA KEV catalog. N-able took its cloud service offline in response to the mass vulnerability disclosure, indicating the severity of the overall situation (Cyberdaily).

1. Reconnaissance: Identify internet-facing N-able N-central instances running versions prior to 26.4.1 using tools like Shodan or Censys, or by querying the N-central web interface for version information.
2. Identify XML-accepting endpoints: Probe N-central's API or web interface for endpoints that accept XML input (e.g., SOAP endpoints, XML-based configuration imports, or data submission forms).
3. Craft malicious XXE payload: Construct an XML document containing an external entity declaration pointing to an attacker-controlled server or a sensitive local file path, for example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

4. Submit payload: Send the crafted XML to the vulnerable endpoint via HTTP POST without authentication.
5. Retrieve exfiltrated data or achieve code execution: If the server resolves the external entity, the response may contain the contents of the referenced file, or — in more advanced exploitation — trigger out-of-band data exfiltration to an attacker-controlled server or execute server-side code via schema poisoning (GitHub Advisory, Feedly).

• Network: Outbound HTTP/HTTPS requests from the N-central server to unexpected external IP addresses or domains, particularly during XML processing operations; DNS lookups to attacker-controlled domains originating from the N-central host.
• Logs: N-central application logs showing XML parsing errors or unusual entity resolution attempts; web server access logs with POST requests to XML-accepting endpoints containing DOCTYPE or ENTITY declarations in the body.
• File System: Unexpected access to sensitive system files (e.g., /etc/passwd, configuration files) by the N-central service account; new or modified files in N-central installation directories.
• Process: Unusual child processes spawned by the N-central Java or application server process; unexpected network connections initiated by the N-central service process.

N-able has released a patch in N-central version 26.4.1 (delivered as HF2 for the 2026.4 release), and all users should upgrade immediately (N-able Status). N-able also took its hosted cloud service offline in response to the broader vulnerability disclosure, advising on-premises customers to follow suit until patched (Cyberdaily). As interim mitigations, restrict network access to N-central administrative interfaces to trusted IP ranges only, disable XML external entity processing in any configurable XML parsers, and implement egress filtering to prevent the N-central server from making outbound connections to untrusted external hosts (Feedly).

The disclosure of CVE-2026-125883 was part of a broader mass vulnerability disclosure event involving 33 N-central vulnerabilities, prompting N-able to issue an emergency hotfix and take its cloud service offline — an unusual and significant response indicating the severity of the situation (CSO Online, Cyberdaily). Tenable published a blog post with frequently asked questions addressing the reported N-central zero-day vulnerabilities under the name "Able2Shell" (Tenable Blog). Security news outlets including SecurityOnline and CTI Pilot covered the event, highlighting the risk to managed service providers relying on N-central for endpoint management (SecurityOnline, CTI Pilot).