{"id":"CVE-2026-125881","kind":"vulnerability","aliases":["CVE-2026-125881"],"related":[],"title":"N-able N-central: server-side request forgery lets attackers reach internal systems","description":"Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery.\n\nThis issue affects N-central: before 26.4.1.","summary":"N-able N-central has a server-side request forgery flaw, meaning the server can be tricked into sending requests to addresses chosen by an attacker. The sources do not say what data or systems can be reached from that position.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["msp","n-central","rmm","vendor"],"not_affected_if":["version-26.4.1-or-later"],"how_to_check":"- Check the installed N-central version in the product's administration interface, or compare it with the version in your deployment records","fix":"- Move N-central to version `26.4.1` or later","status":"open","published_at":"2026-11-10T22:18:30+00:00","first_seen_at":"2026-11-10T22:27:29+00:00","triaged_at":"2026-11-10T22:28:48+00:00","updated_at":"2026-11-10T22:28:48+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T22:28:48Z","model":"claude-haiku-5-5","output":{"fix":"- Move N-central to version `26.4.1` or later\n- unknown","reach":"unknown","title":"N-able N-central: server-side request forgery lets attackers reach internal systems","impact":"high","summary":"N-able N-central has a server-side request forgery flaw, meaning the server can be tricked into sending requests to addresses chosen by an attacker. The sources do not say what data or systems can be reached from that position.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["n-central","msp","rmm"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker makes the server request internal addresses and services","analyst_note":"Confirm the attack prerequisites (authentication, endpoint) and what internal resources are reachable, using the N-able advisory and NVD entry.","how_to_check":"- Check the installed N-central version in the product's administration interface, or compare it with the version in your deployment records\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-26.4.1-or-later"],"who_is_affected":"N-central instances before `26.4.1` are affected according to the description. The sources do not describe the request path or required configuration, so whether a given deployment is reachable from the internet is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000692,"input_tokens":4513,"output_tokens":482,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-125881':19A,22A '-2026':18A,21A '26.4.1':99C 'abl':3A,31B,83C 'address':53B 'affect':94C 'allow':87C 'attack':13A,57B 'central':6A,26B,34B,86C,97C 'chosen':54B 'cve':17A,20A 'data':64B 'flaw':42B 'forgeri':11A,41B,77C,91C 'intern':15A 'issu':93C 'let':12A 'mean':43B 'msp':23B 'n':2A,5A,25B,30B,33B,82C,85C,96C 'n-abl':1A,29B,81C 'n-central':4A,24B,32B,84C,95C 'posit':72B 'reach':14A,69B 'request':10A,40B,51B,76C,90C 'rmm':27B 'say':62B 'send':50B 'server':8A,38B,45B,74C,88C 'server-sid':7A,37B,73C 'side':9A,39B,75C,89C 'sourc':59B 'ssrf':78C 'system':16A,66B 'trick':48B 'vendor':28B 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"N-central instances before `26.4.1` are affected according to the description. The sources do not describe the request path or required configuration, so whether a given deployment is reachable from the internet is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","msp","ncentral","rmm","vendor"],"campaign_type":null,"search_a":"'-125881':19A,22A '-2026':18A,21A 'abl':3A 'attack':13A 'central':6A 'cve':17A,20A 'forgeri':11A 'intern':15A 'let':12A 'n':2A,5A 'n-abl':1A 'n-central':4A 'reach':14A 'request':10A 'server':8A 'server-sid':7A 'side':9A 'system':16A","search_b":"'abl':31B 'address':53B 'attack':57B 'central':26B,34B 'chosen':54B 'data':64B 'flaw':42B 'forgeri':41B 'mean':43B 'msp':23B 'n':25B,30B,33B 'n-abl':29B 'n-central':24B,32B 'posit':72B 'reach':69B 'request':40B,51B 'rmm':27B 'say':62B 'send':50B 'server':38B,45B 'server-sid':37B 'side':39B 'sourc':59B 'system':66B 'trick':48B 'vendor':28B","search_c":"'26.4.1':99C 'abl':83C 'affect':94C 'allow':87C 'central':86C,97C 'forgeri':77C,91C 'issu':93C 'n':82C,85C,96C 'n-abl':81C 'n-central':84C,95C 'request':76C,90C 'server':74C,88C 'server-sid':73C 'side':75C,89C 'ssrf':78C 'vulner':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125881","severity":null,"published_at":"2026-11-10T22:18:30+00:00","modified_at":"2026-11-10T22:18:30+00:00","first_seen_at":"2026-11-10T22:27:29+00:00","fetched_at":"2026-11-10T22:27:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}