{"id":"EUVD-2026-122942","enisaUuid":"386865cd-6f0f-3772-a0da-9b4ef534c8b9","description":"Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning.\n\nThis issue affects N-central: before 26.4.1.","datePublished":"Nov 10, 2026, 9:19:11 PM","dateUpdated":"Nov 12, 2026, 4:56:22 AM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://me.n-able.com/s/security-advisory/aArVy0000002ihhKAA/cve2026125883-multiple-xxe-vulnerabilities\n","aliases":"CVE-2026-125883\nGHSA-4pwj-r4p2-8gqv\n","assigner":"N-able","epss":0.88,"enisaIdProduct":[{"id":"4d790e09-143b-3a52-a2cb-fddba33a06f6","product":{"name":"N-central","vendor":{"name":"N-Able"}},"product_version":"0 \u003c26.4.1"}],"enisaIdVendor":[{"id":"45544fd4-9062-3f5c-8890-07818e1f9237","vendor":{"name":"N-Able"}}],"enisaIdVulnerability":[{"id":"34609ba5-d52e-3eff-b1c8-8630403c6da4","vulnerability":{"id":"CVE-2026-125883","description":"Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning.\n\nThis issue affects N-central: before 26.4.1.","datePublished":"Nov 10, 2026, 9:19:11 PM","dateUpdated":"Nov 12, 2026, 4:56:22 AM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://me.n-able.com/s/security-advisory/aArVy0000002ihhKAA/cve2026125883-multiple-xxe-vulnerabilities\n","enisa_id":"EUVD-2026-122942\n","assigner":"N-able","epss":0.88,"dataProcessed":"Nov 12, 2026, 10:00:31 PM","vulnerabilityProduct":[{"id":"d653f5e8-7ecd-3bd8-a88f-a19453cf39a0","product":{"name":"N-central","vendor":{"name":"N-Able"}},"product_version":"0 \u003c26.4.1"}],"vulnerabilityVendor":[{"id":"9c071c47-db56-3ff0-a9ac-ff00b604fc73","vendor":{"name":"N-Able"}}]}},{"id":"9781995f-d538-3a5c-bcad-2c7ea353569c","vulnerability":{"id":"GHSA-4pwj-r4p2-8gqv","description":"Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning.\n\nThis issue affects N-central: before 26.4.1.","datePublished":"Nov 11, 2026, 12:32:33 AM","dateUpdated":"Nov 11, 2026, 3:30:54 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-125883\nhttps://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able#anonymous-service-import-xxe-rce\nhttps://me.n-able.com/s/security-advisory/aArVy0000002ihhKAA/cve2026125883-multiple-xxe-vulnerabilities\n","enisa_id":"EUVD-2026-122942\n","aliases":"GHSA-4pwj-r4p2-8gqv\nCVE-2026-125883\n","epss":0.0,"dataProcessed":"Nov 12, 2026, 10:01:47 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"f281404e-2dd2-3433-a7c7-9b6f02c93876","advisory":{"id":"WID-SEC-W-2026-4440","description":"N-able N-Central: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in N-able N-Central ausnutzen, um vertrauliche Informationen offenzulegen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Administratorrechte zu erlangen oder beliebigen Code und Betriebssystembefehle mit Root- oder Nable-Rechten auszuführen.","datePublished":"Nov 9, 2026, 11:00:00 PM","dateUpdated":"Nov 10, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4440.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-4440\n","aliases":"CVE-2026-125878\nCVE-2026-125879\nCVE-2026-125880\nCVE-2026-125881\nCVE-2026-125882\nCVE-2026-125883\nCVE-2026-125958\nCVE-2026-91000\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"311bf555-9a11-3518-bad2-9dfb8dffb5d4","product":{"name":"On-premise APAC","vendor":{"name":"N-Able"}}},{"id":"3c11f4a8-1b7e-3a5d-86d2-97b68e2a042f","product":{"name":"On-premise Europe","vendor":{"name":"N-Able"}}},{"id":"4697bbc1-10bf-39a0-ab76-194d2490c4b2","product":{"name":"On-premise Americas","vendor":{"name":"N-Able"}}},{"id":"5e608d70-fd19-3fa8-b6b7-51991edfa18f","product":{"name":"2026.4 Hotfix 2","vendor":{"name":"N-Able"}}},{"id":"700c1f25-0e92-352c-9cf9-33852dd1baa0","product":{"name":"hosted version Americas","vendor":{"name":"N-Able"}}},{"id":"82bf8786-5f97-3790-8245-4916e90c4363","product":{"name":"N-central","vendor":{"name":"N-Able"}}},{"id":"b3fadd4b-8312-3a74-8ee2-158e85298ab4","product":{"name":"2026.4.1.26","vendor":{"name":"N-Able"}}},{"id":"c5e60aa0-ad12-3864-b89d-2962822a96a7","product":{"name":"hosted version APAC","vendor":{"name":"N-Able"}}},{"id":"f40d59a4-1a98-3cc4-8934-4c1a4f643493","product":{"name":"hosted version Europe","vendor":{"name":"N-Able"}}}]}}]}