{"id":"EUVD-2026-122961","enisaUuid":"387cf8f5-c6d4-3be8-bdf6-8d8694ee4a8e","description":"Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery.\n\nThis issue affects N-central: before 26.4.1.","datePublished":"Nov 10, 2026, 9:24:33 PM","dateUpdated":"Nov 10, 2026, 9:24:33 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://me.n-able.com/s/security-advisory/aArVy0000002io9KAA/cve2026125881-schemahint-ssrf-via-service-import-schema-validation\n","aliases":"CVE-2026-125881\nGHSA-g9mp-wv4p-9gf5\n","assigner":"N-able","epss":0.48,"enisaIdProduct":[{"id":"561356ca-d296-3d7e-a6b7-9b96988028dd","product":{"name":"N-central","vendor":{"name":"N-Able"}},"product_version":"0 \u003c26.4.1"}],"enisaIdVendor":[{"id":"9755b406-fb3f-3430-9070-e49b4855d9d9","vendor":{"name":"N-Able"}}],"enisaIdVulnerability":[{"id":"3a7d5931-c2b2-36d4-b044-8cb413747d70","vulnerability":{"id":"CVE-2026-125881","description":"Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery.\n\nThis issue affects N-central: before 26.4.1.","datePublished":"Nov 10, 2026, 9:24:33 PM","dateUpdated":"Nov 10, 2026, 9:24:33 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://me.n-able.com/s/security-advisory/aArVy0000002io9KAA/cve2026125881-schemahint-ssrf-via-service-import-schema-validation\n","enisa_id":"EUVD-2026-122961\n","assigner":"N-able","epss":0.48,"dataProcessed":"Nov 12, 2026, 10:00:59 PM","vulnerabilityProduct":[{"id":"118b27c1-a795-368a-bbe3-8bd9d379edd9","product":{"name":"N-central","vendor":{"name":"N-Able"}},"product_version":"0 \u003c26.4.1"}],"vulnerabilityVendor":[{"id":"89caae73-6612-3ba5-b93d-4018844fda8f","vendor":{"name":"N-Able"}}]}},{"id":"9ac9834c-d3cf-3739-9d73-cb876b75216f","vulnerability":{"id":"GHSA-g9mp-wv4p-9gf5","description":"Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery.\n\nThis issue affects N-central: before 26.4.1.","datePublished":"Nov 11, 2026, 12:32:33 AM","dateUpdated":"Nov 11, 2026, 12:32:33 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-125881\nhttps://me.n-able.com/s/security-advisory/aArVy0000002io9KAA/cve2026125881-schemahint-ssrf-via-service-import-schema-validation\n","enisa_id":"EUVD-2026-122961\n","aliases":"GHSA-g9mp-wv4p-9gf5\nCVE-2026-125881\n","epss":0.0,"dataProcessed":"Nov 12, 2026, 10:01:47 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"fd73a7a6-e8f1-322c-99d1-2e9bb4315835","advisory":{"id":"WID-SEC-W-2026-4440","description":"N-able N-Central: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in N-able N-Central ausnutzen, um vertrauliche Informationen offenzulegen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Administratorrechte zu erlangen oder beliebigen Code und Betriebssystembefehle mit Root- oder Nable-Rechten auszuführen.","datePublished":"Nov 9, 2026, 11:00:00 PM","dateUpdated":"Nov 10, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4440.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-4440\n","aliases":"CVE-2026-125878\nCVE-2026-125879\nCVE-2026-125880\nCVE-2026-125881\nCVE-2026-125882\nCVE-2026-125883\nCVE-2026-125958\nCVE-2026-91000\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"311bf555-9a11-3518-bad2-9dfb8dffb5d4","product":{"name":"On-premise APAC","vendor":{"name":"N-Able"}}},{"id":"3c11f4a8-1b7e-3a5d-86d2-97b68e2a042f","product":{"name":"On-premise Europe","vendor":{"name":"N-Able"}}},{"id":"4697bbc1-10bf-39a0-ab76-194d2490c4b2","product":{"name":"On-premise Americas","vendor":{"name":"N-Able"}}},{"id":"5e608d70-fd19-3fa8-b6b7-51991edfa18f","product":{"name":"2026.4 Hotfix 2","vendor":{"name":"N-Able"}}},{"id":"700c1f25-0e92-352c-9cf9-33852dd1baa0","product":{"name":"hosted version Americas","vendor":{"name":"N-Able"}}},{"id":"82bf8786-5f97-3790-8245-4916e90c4363","product":{"name":"N-central","vendor":{"name":"N-Able"}}},{"id":"b3fadd4b-8312-3a74-8ee2-158e85298ab4","product":{"name":"2026.4.1.26","vendor":{"name":"N-Able"}}},{"id":"c5e60aa0-ad12-3864-b89d-2962822a96a7","product":{"name":"hosted version APAC","vendor":{"name":"N-Able"}}},{"id":"f40d59a4-1a98-3cc4-8934-4c1a4f643493","product":{"name":"hosted version Europe","vendor":{"name":"N-Able"}}}]}}]}