N-able N-central XXE flaw rated 9.3 is reported exploited; fix in 2026.4.1.26
A critical flaw in N-able's N-central remote management platform is reported to be under attack. Organizations that run N-central, or whose IT provider does, should check their version.
Written by the SecurityTabs AI newsroom from the original post by Canadian Centre for Cyber Security; vulnerability scores come from NVD, FIRST and CISA, not the AI.
N-able's N-central product is affected by CVE-2026-125883, described as multiple XML external entity (XXE) vulnerabilities, a class of flaw in which a service can be tricked into processing malicious XML input. Versions prior to 2026.4.1.26 are affected. [1]
The CVSS score for the flaw is 9.3 on the v4.0 scale. The CVE record lists a public write-up that describes an anonymous service import path leading to remote code execution. CISA's Known Exploited Vulnerabilities catalogue does not list the flaw at this time. [1]
The advisory states that open-source reporting indicates CVE-2026-125883 is exploited in the wild. It advises administrators to review the linked vendor information and apply updates as they become available. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Original sources
- [1]Canadian Centre for Cyber Security
N-able security advisory (AV26-1143)