Multiple critical security vulnerabilities have been identified in N-able N-central, a remote monitoring and management (RMM) platform used by managed service providers (MSPs) and IT teams to administer customer networks and endpoints. The vulnerabilities, collectively referred to as Able2Shell, involve XML External Entity (XXE) injection, OGNL injection, server-side request forgery (SSRF), stored cross-site scripting (XSS), path traversal, and insecure inter-process communication (IPC). Successful exploitation could allow unauthenticated attackers to execute arbitrary commands, create unauthorized administrator accounts, access sensitive information, and escalate privileges to root, potentially compromising the N-central server and connected customer environments. The researcher disclosed 33 alleged vulnerabilities and multiple exploit chains, while seven CVEs were subsequently published for issues addressed in N-able's security hotfix.
CVE-2026-125883 (CVSS 9.3 – Critical): Multiple XML External Entity (XXE) vulnerabilities in N-central allow unauthenticated attackers to exploit XML processing functionality, potentially access sensitive local resources, obtain session information, and execute commands as the `nable` service account through an exploit chain.[/subscribe_to_unlock_form]
Multiple critical security vulnerabilities have been identified in N-able N-central, a remote monitoring and management (RMM) platform used by managed service providers (MSPs) and IT teams to administer customer networks and endpoints. The vulnerabilities, collectively referred to as Able2Shell, involve XML External Entity (XXE) injection, OGNL injection, server-side request forgery (SSRF), stored cross-site scripting (XSS), path traversal, and insecure inter-process communication (IPC). Successful exploitation could allow unauthenticated attackers to execute arbitrary commands, create unauthorized administrator accounts, access sensitive information, and escalate privileges to root, potentially compromising the N-central server and connected customer environments. The researcher disclosed 33 alleged vulnerabilities and multiple exploit chains, while seven CVEs were subsequently published for issues addressed in N-able's security hotfix.
CVE-2026-125883 (CVSS 9.3 – Critical): Multiple XML External Entity (XXE) vulnerabilities in N-central allow unauthenticated attackers to exploit XML processing functionality, potentially access sensitive local resources, obtain session information, and execute commands as the `nable` service account through an exploit chain.[emaillocker id="1283"]
CVE-2026-125881 (CVSS 9.3 – Critical): A server-side request forgery (SSRF) vulnerability in service-import schema validation allows attackers to manipulate schema references and cause the application to make unauthorized requests to internal services, potentially exposing sensitive information and internal resources.
CVE-2026-125878 (CVSS 8.7 – High): Multiple Object-Graph Navigation Language (OGNL) injection vulnerabilities allow attackers to inject malicious expressions into application processing. When chained with stored XSS vulnerabilities, these flaws can enable arbitrary command execution under the `nable` account.
CVE-2026-125879 (CVSS 8.6 – High): An improper privilege-management vulnerability involving a syslog-ng configuration file writable by the `nable` account allows a local attacker to manipulate the configuration and escalate privileges to root, resulting in potential complete system compromise.
CVE-2026-125882 (CVSS 8.6 – High): A path traversal vulnerability in the file repository upload functionality allows attackers to write files outside the intended directory. Successful exploitation may enable arbitrary code execution and compromise the affected N-central server.
CVE-2026-91000 (CVSS 8.4 – High): Insecure inter-process communication (IPC) channels allow a local attacker to exploit insufficient access controls between processes and potentially escalate privileges to root on the affected system.
CVE-2026-125880 (CVSS 8.3 – High): A stored cross-site scripting vulnerability in MMS3 patch metadata allows attackers to store malicious scripts that execute when an administrator views the affected patch information. This can be chained with other vulnerabilities to execute commands as the `nable` user or escalate privileges to root through the audit export functionality.
The vulnerabilities were tested against N-central Appliance 2026.4.0.31, with the researcher indicating that earlier versions may also be affected. N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) to address the seven published CVEs and recommended that on-premises customers upgrade immediately. Hosted N-central environments across global regions were also upgraded. Although scanning and probing activity associated with the publicly disclosed proof-of-concept code has been observed, no confirmed compromise of customer environments was reported in the available updates. Administrators should apply the security hotfix, follow the vendor's upgrade guidance before restoring server connectivity, and investigate suspicious administrator accounts, configuration changes, file uploads, and unexpected command execution.
We recommend you to update N-central to version 2026.4.1.26.
The following reports contain further technical details:
[/emaillocker]