CYBUNKR

N-able N-central again:a new no-login takeover flaw, exploit code public and attacks seen

Published

CVE-2026-125883 lets an attacker take over an N-able N-central server without logging in. Exploit code is public and attack attempts have been seen. Self-hosted servers need 2026.4 HF2; ask your IT provider.

N-able N-central, the software many IT providers use to manage their customers' computers, has another critical flaw. CVE-2026-125883 is a set of XML flaws (XXE) that can be reached with no login (CVE record). Working exploit code that turns it into a server takeover was published on 9 November (Oracle-Security on GitHub), and attack attempts started the same day (Previdian). If your IT is outsourced, ask your provider today whether their N-central is on 2026.4 HF2.

N-able released 2026.4 HF2 (build 2026.4.1.26) on 10 November and calls it a critical security update (N-able). The CVE record lists every N-central version before 26.4.1 as affected (CVE record).

Who is affected

  • Self-hosted N-central before 2026.4 HF2 (2026.4.1.26). It is rated 9.3 out of 10 (CVE record, N-able advisory).
  • Hosted N-central: N-able upgrades hosted servers itself. Hosted and self-hosted customers must both upgrade their Agents and Probes (N-able).
  • Your business, if your IT provider manages your computers with N-central. Whoever controls the server can reach the machines it manages (ProjectDiscovery).
  • This is a different flaw from CVE-2026-86218, the N-central takeover flaw we covered on 10 November. A server patched for that one still needs HF2.

What has been seen so far

A snapshot from 12 November:

  • On 9 November the Oracle-Security group published more than 30 N-central exploits on GitHub. One chains the XML flaw into running commands on the server with no login, and can add a new administrator account (Oracle-Security on GitHub). They say they tested on 2026.4.0.31 and that the flaws were unpatched when they posted them.
  • Previdian's sensors logged 131 attempts to exploit CVE-2026-125883 from 3 addresses in 3 countries between 9 and 11 November (Previdian). These are attempts against sensors, not confirmed break-ins. CIRCL's Vulnerability-Lookup lists it as exploited.
  • CISA's assessment in the CVE record says a proof of concept exists and the attack is automatable (CVE record). It is not yet in CISA's Known Exploited Vulnerabilities catalog.
  • N-able has not said whether any customer servers have been attacked.

What to do

  • Outsourced IT? Ask your provider: do they use N-central, is it self-hosted, and is it on 2026.4 HF2 (2026.4.1.26)? Ask whether they have checked it for new administrator accounts since 9 November.
  • Run N-central yourself? Upgrade the server to 2026.4 HF2 now. Then upgrade Agents first and Probes second, as N-able advises, so they keep talking to each other (N-able).
  • Check for misuse: look for N-central users nobody recognises, especially administrators, and for scripts or software pushed to devices that nobody asked for. Limit access to the N-central web console to known addresses or a VPN where you can.

How we can help

Not sure how your IT provider protects the tools that manage your computers? Get in touch.

Sources