---
id: "CVE-2026-125881"
page: "https://infrastack.ai/live/CVE-2026-125881"
kind: "vulnerability"
aliases: ["CVE-2026-125881"]
title: "N-able N-central: server-side request forgery lets attackers reach internal systems"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["msp", "n-central", "rmm", "vendor"]
not_affected_if: ["version-26.4.1-or-later"]
published_at: "2026-11-10T22:18:30+00:00"
first_seen_at: "2026-11-10T22:27:29+00:00"
updated_at: "2026-11-10T22:28:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125881", "first_seen_at": "2026-11-10T22:27:29+00:00"}]
exploit_sources: []
---

# N-able N-central: server-side request forgery lets attackers reach internal systems

Link for people: https://infrastack.ai/live/CVE-2026-125881 (this .md is for agents)

N-able N-central has a server-side request forgery flaw, meaning the server can be tricked into sending requests to addresses chosen by an attacker. The sources do not say what data or systems can be reached from that position.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed N-central version in the product's administration interface, or compare it with the version in your deployment records

## Fix

- Move N-central to version `26.4.1` or later

## Timeline

- 2026-11-10T22:27:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125881

## From the sources

Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery.

This issue affects N-central: before 26.4.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_