CVE-2026-125878: Multiple OGNL Injection vulnerabilities

Q: Which deployments are affected?

N-able N-central versions before 26.4.1 are affected.

Q: What level of access does an attacker need?

The supplied CVSS vector indicates that an attacker needs low privileges and can attack over the network without user interaction.

Q: What is the likely security impact?

The CVSS vector indicates high impact to confidentiality and integrity, with low impact to availability. The advisory reference describes the OGNL injection issues as leading to remote code execution.

Published Nov 10, 2026

Updated

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection.

This issue affects N-central: before 26.4.1.

Affected Software

1 affected component

N-able N-Central<26.4.1

Event History

Nov 10, 2026

CVE Published

via MITRE·09:22 PM

Data Sourced

via MITRE·09:22 PM

DescriptionWeakness

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

N-able N-central versions before 26.4.1 are affected.

What level of access does an attacker need?

The supplied CVSS vector indicates that an attacker needs low privileges and can attack over the network without user interaction.

What is the likely security impact?

The CVSS vector indicates high impact to confidentiality and integrity, with low impact to availability. The advisory reference describes the OGNL injection issues as leading to remote code execution.

CVE-2026-125878: Multiple OGNL Injection vulnerabilities

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What is the likely security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What is the likely security impact?