CVE-2026-125958: 
N-central Analyse et atténuation de la vulnérabilité

CVE-2026-125958 is a "Download of Code Without Integrity Check" vulnerability (CWE-494) in N-able N-central that enables Remote Code Inclusion. It affects N-central versions through 24.6.1, with no version explicitly listed as patched at time of disclosure. The vulnerability was published on November 10, 2026, and assigned a CVSS v4.0 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-494 (Download of Code Without Integrity Check): N-central downloads code or executable packages from a remote location without sufficiently verifying their origin or integrity, allowing an attacker to substitute malicious content. The attack vector is network-based, requiring high privileges and high attack complexity, with no user interaction needed. The vulnerability is specifically described as exploitable via unsigned NSP upgrade package uploads, suggesting the upgrade mechanism lacks cryptographic signature validation (GitHub Advisory, N-able Advisory). No public proof-of-concept code has been identified at this time (Feedly).

Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) with root-level privileges on affected N-central systems, resulting in high confidentiality, integrity, and availability impact to the vulnerable system. Because N-central is a remote monitoring and management (RMM) platform used to manage endpoints across customer environments, compromise of the N-central server could enable lateral movement to all managed devices and networks. Data exposure risk is significant given N-central's role in storing credentials, agent configurations, and managed endpoint data (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges, which somewhat limits the attack surface, though the RCE-via-upgrade-package vector is a well-understood attack class for RMM platforms (GitHub Advisory).

1. Obtain High-Privilege Access: Acquire administrative credentials to the N-central management console (e.g., through credential theft, phishing, or reuse of compromised accounts).
2. Identify Upgrade Mechanism: Navigate to the N-central upgrade or software deployment interface that accepts NSP (N-central Software Package) upgrade packages.
3. Craft Malicious Package: Prepare a malicious NSP upgrade package containing arbitrary executable code or a backdoor, exploiting the absence of cryptographic signature verification.
4. Upload Malicious Package: Upload the unsigned malicious NSP package through the N-central administrative interface, bypassing integrity checks.
5. Trigger Execution: Initiate the upgrade or deployment process, causing N-central to download and execute the malicious code with root-level privileges on the server.
6. Achieve Persistence and Lateral Movement: Use the resulting root shell to establish persistence, exfiltrate credentials, and leverage N-central's agent infrastructure to push malicious payloads to all managed endpoints (GitHub Advisory, N-able Advisory).

• Network: Unexpected outbound connections from the N-central server to unknown external IP addresses following an upgrade event; unusual download activity from non-N-able domains during upgrade processes.
• File System: Presence of unexpected or unsigned NSP package files in N-central upgrade directories; new or modified executables in N-central installation paths with recent timestamps coinciding with upgrade events.
• Logs: N-central application logs showing upgrade package installations from non-standard or unrecognized sources; failed or anomalous integrity check log entries (if any logging exists for package validation).
• Process: Unexpected child processes spawned by the N-central service process (e.g., shells, scripting interpreters, network tools); processes running as root that are not part of normal N-central operations.
• Authentication: Audit logs showing high-privilege logins to the N-central console from unusual IP addresses or at unusual times preceding a suspicious upgrade event (Feedly, N-able Advisory).

Update N-able N-central to a version later than 24.6.1 as soon as a patched release is made available by N-able (GitHub Advisory). In the interim, implement network-level controls to restrict which hosts can initiate upgrade package downloads and limit administrative access to the N-central console to trusted IP ranges. Monitor N-able's official security advisory portal for patch availability and apply updates immediately upon release (N-able Advisory). Review and enforce the principle of least privilege for N-central administrative accounts to reduce the risk of credential compromise enabling exploitation.