CVE-2026-125958: Root RCE via unsigned NSP upgrade package upload

Q: Which deployments are affected?

N-able N-central versions through 24.6.1 are affected.

Q: What level of access does an attacker need?

The vector requires high privileges (PR:H). The provided data does not identify the specific role or interface that grants the required access.

Q: Does exploitation require user interaction or local access?

No user interaction is required, and the attack vector is network-based (AV:N). Exploitation is rated high complexity (AC:H).

Q: What is the likely impact of successful exploitation?

Successful exploitation can result in remote code inclusion and root remote code execution. Confidentiality, integrity, and availability impacts are all rated high.

Published Nov 10, 2026

Updated

Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion.

This issue affects N-central: through 24.6.1.

Affected Software

1 affected component

N-able N-Central<=24.6.1

Event History

Nov 10, 2026

CVE Published

via MITRE·09:21 PM

Data Sourced

via MITRE·09:21 PM

DescriptionWeakness

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

N-able N-central versions through 24.6.1 are affected.

What level of access does an attacker need?

The vector requires high privileges (PR:H). The provided data does not identify the specific role or interface that grants the required access.

Does exploitation require user interaction or local access?

No user interaction is required, and the attack vector is network-based (AV:N). Exploitation is rated high complexity (AC:H).

What is the likely impact of successful exploitation?

Successful exploitation can result in remote code inclusion and root remote code execution. Confidentiality, integrity, and availability impacts are all rated high.

CVE-2026-125958: Root RCE via unsigned NSP upgrade package upload

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

Does exploitation require user interaction or local access?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

Does exploitation require user interaction or local access?

What is the likely impact of successful exploitation?