# CVE-2026-125883

XXE in N-able N-central allows XML schema poisoning leading to RCE/data theft

- Page: https://www.vulneraibility.com/cve/CVE-2026-125883
- CVSS: 9.3
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation poc, automatable yes, technical impact total (assessed 2026-11-11)
- Weakness: CWE-611
- Published: 2026-11-10

## Affected versions

- N-able N-central: affected < 26.4.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Attackers can trigger XML External Entity processing to achieve remote code execution, SSRF and local file disclosure on N-central servers.

## Action

Immediate action required

## Recommendation

Upgrade to 26.4.1+ and disable XML external entity processing; audit MSP access.

## References

- [advisory] https://me.n-able.com/s/security-advisory/aArVy0000002ihhKAA/cve2026125883-multiple-xxe-vulnerabilities
- [exploit] https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able#anonymous-service-import-xxe-rce

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.