Search: CVE-2026-125881

CVE-2026-125881 is a critical Server-Side Request Forgery (SSRF) vulnerability in N-able N-central versions before 26.4.1. This flaw allows an attacker to induce the server to make unintended requests, potentially leading to unauthorized access or information disclosure. The vulnerability is fixed in version 26.4.1.

Able2Shell is a collection of 33 reported zero-day vulnerabilities in N-able N-central, disclosed publicly with proof-of-concept code. Among these, seven critical vulnerabilities have been officially recognized and patched by N-able in the N-central 2026.4 Hotfix 2 release. The vulnerabilities include high-severity issues such as XML external entity (XXE) attacks, server-side request forgery (SSRF), OGNL injection, local privilege escalation, remote code execution, and stored cross-site scripting (XSS). One exploit chain allows unauthenticated remote command execution as the nable user, and others can lead to root privileges through chained exploits. N-able has confirmed and patched the most critical issues but has not mapped all 33 findings individually. The affected versions are N-central prior to 2026.4.1.26. No confirmed customer compromises have been reported as of November 10, 2026.