Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

N-able Releases Security Update for N-central

Security update for N-central addresses seven vulnerabilities, including two critical and five high severity vulnerabilities

Threat ID:
CC-4891
Threat Severity:
Medium
Published:
11 November 2026 3:49 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security update for N-central addresses seven vulnerabilities, including two critical and five high severity vulnerabilities

Affected platforms

The following platforms are known to be affected:

N-able N-central

  • All prior to version 2026.4 Hotfix 2 (HF2)

Threat details

Introduction

N-able have released a security update covering seven vulnerabilities for N-central, including two critical and five high severity vulnerabilities.

Exploitation attempts observed

Security researchers have observed exploitation attempts in-the-wild.

The NHS England National CSOC assesses further exploitation as likely.

Vulnerability Details

  • CVE-2026-125881 - "Server-Side request forgery" vulnerability - CVSSv4 score: 9.3
  • CVE-2026-125883 - "Improper restriction of XML external entity reference" vulnerability - CVSSv4 score: 9.3

  • CVE-2026-125878 - "Improper neutralisation of input during web page generation" vulnerability - CVSSv4 score: 8.7

  • CVE-2026-125879 - "Incorrect privilege assignment" vulnerability - CVSSv4 score: 8.6

  • CVE-2026-125882 - "Relative path traversal" vulnerability - CVSSv4 score: 8.6

  • CVE-2026-91000 - "Missing authentication for critical function" vulnerability - CVSSv4 score: 8.4

  • CVE-2026-125880 - "Improper neutralisation of HTTP headers for scripting syntax" vulnerability - CVSSv4 score: 8.3

Remediation advice

Affected organisations are encouraged to review N-able's N-central 2026.4 HF2 Release Notes and apply the relevant update as soon as possible.

Organisations are strongly recommended to take N-central servers offline until the patch can be applied.

Last edited: 11 November 2026 3:49 pm