What it is
VULN-2026-0007 is an unauthenticated vulnerability affecting N-able N-central.
Vulnerability report
No Exploitation Yet
No CVE Assigned Yet
VULN-2026-0007
N-central Remote Code Execution
N-able / N-central
- Severity
- CVSS 9.8 · Critical
- Confidence
- —
- Exploit status
- PoC Available
- EPSS
- —
- First observed
- —
- Last observed
- —
Decision summary
What security teams need to know first
Direct answers before the deeper technical record.
Have exploitation attempts been observed?
Previdian records an exploitation-related signal (poc available). This CVE has not been added as a known exploited vulnerability.
Who is affected?
N-able / N-central.
What should we do?
Track for updates. Assess relevance to your asset inventory and enrichment workflows.
Overview
N-central Remote Code Execution
An unauthenticated exploit chain in N-able N-central is reported to allow remote attackers to execute arbitrary operating-system commands as the nable service account. The chain combines anonymous SOAP log uploads, XML external entity (XXE) processing in the service-import functionality before session validation, and abuse of an internal privileged session. These weaknesses allow an attacker to write a JSP payload and reset an existing account’s password.
The attacker can then authenticate using the attacker-controlled password and execute the payload. The researcher also reports the ability to create an administrative account following account takeover. Testing was reported against N-central Appliance version 2026.4.0.31; the complete affected-version range remains unconfirmed.
- Published
- 09 Nov 2026
- Exploitation date
- —
- Attack vector
- Remote
- Complexity
- Low
- Privileges
- None
- User interaction
- None
CVE References
- IMPORTANT: N-central Critical Security Incident N-able N-Central · Vendor Advisory https://uptime.n-able.com/event/202561/
- N-able takes N-central offline as alleged zero-day exploits surface Field Effect Security Intelligence Team · Analysis https://fieldeffect.com/blog/n-central-offline-alleged-zero-days
- N-able N-central Critical Vulnerabilities: What We Know So Far Previdian Blog · Analysis https://blog.previdian.com/n-able-n-central-critical-vulnerabilities-...
Exploitation evidence
Exploitation evidence for this CVE
These signals relate to exploitability. Previdian has not added this CVE as a known exploited vulnerability.
Proof of concept available
Public scanner or PoC coverage increases practical exploitability.
Detection
Operational artifacts and observed signals
Make the evidence actionable in scanner, SOC, and edge-control workflows.
Scanner coverage
No scanner integrations recorded yet.
Virtual patch status
No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.
Learn about virtual patches →No detection artifacts or sensor request patterns are available for this CVE yet.
Check back as sensor telemetry and scanner integrations are updated.
Risk and context
Severity, weaknesses, and research context
CVSS v3.1
9.8
Critical
Potential damage if exploited. Separate from whether attackers are using it.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
—
Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.
Potential Proof of Concepts
These PoCs are unverified and could contain malware. Use at your own risk.
anonymous_xxe_nable_rce.py
public · Created 2026-11-09 18:35:00 UTC
Timeline
From disclosure to today
-
18:35 UTC
Public PoC available
Public proof-of-concept code published
-
17:35 UTC
Added to the Previdian watchlist
Added to the Previdian curated list for closer monitoring
-
17:09 UTC
VULN published
Vulnerability disclosed publicly
Pro API
Automate this intelligence
Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
- Evidence confidence and provenance
- First-party sensor telemetry
- PoC and scanner references
- Affected versions and enrichment
- Automation-ready JSON delivery
GET /api/v2/pro/kevs/VULN-2026-0007
Sample API response{
"cve_id": "VULN-2026-0007",
"confidence": null,
"cvss_score": 9.8,
"cvss_estimated": false,
"epss_score": null,
"exploit_status": {
"exploited_in_the_wild": false,
"active_exploitation_observed": false
},
"sensor_telemetry": { "attempts": 0, "sensors": 0 }
}