# CVE-2026-125881

SSRF in N-able N-central (<26.4.1) allowing internal and cloud metadata access

- Page: https://www.vulneraibility.com/cve/CVE-2026-125881
- CVSS: 9.3
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.47% (percentile 41.5)
- Weakness: CWE-918
- Published: 2026-11-10

## Affected versions

- N-able N-central: affected < 26.4.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote SSRF enables server requests to internal services and cloud metadata endpoints; can lead to credential theft, data exfiltration, and lateral pivoting.

## Action

Immediate action required

## Recommendation

Upgrade N-central to 26.4.1+, restrict access to management interfaces, rotate exposed credentials.

## References

- [advisory] https://me.n-able.com/s/security-advisory/aArVy0000002io9KAA/cve2026125881-schemahint-ssrf-via-service-import-schema-validation

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.