{"dataType":"CVE_RECORD","dataVersion":"5.0","cveMetadata":{"cveId":"GCVE-110-NCSC-2026-478","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-11-11T08:12:42Z","dateUpdated":"","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"nl","value":"N-able N-central versions prior to 26.4.1 contain a vulnerability involving improper restriction of XML external entity references, resulting in XML Schema Poisoning.","supportingMedia":null},{"lang":"nl","value":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","supportingMedia":null},{"lang":"nl","value":"N-able N-central versions prior to 26.4.1 are susceptible to cross-site scripting vulnerabilities caused by improper input neutralization during web page generation, potentially enabling resource injection attacks.","supportingMedia":null},{"lang":"nl","value":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","supportingMedia":null},{"lang":"nl","value":"N-able N-central versions prior to 26.4.1 contain a vulnerability due to incorrect privilege assignment that enables privilege escalation.","supportingMedia":null},{"lang":"nl","value":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","supportingMedia":null},{"lang":"nl","value":"N-able N-central versions prior to 26.4.1 are susceptible to Cross-Site Scripting (XSS) vulnerabilities due to inadequate neutralization of HTTP headers containing scripting syntax.","supportingMedia":null},{"lang":"nl","value":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","supportingMedia":null},{"lang":"nl","value":"N-able N-central versions prior to 26.4.1 contain a Server-Side Request Forgery (SSRF) vulnerability that could be exploited to manipulate server requests.","supportingMedia":null},{"lang":"nl","value":"N-able N-central versions prior to 26.4.1 contain a relative path traversal vulnerability that enables attackers to perform path traversal attacks, potentially compromising system security.","supportingMedia":null},{"lang":"nl","value":"A missing authentication vulnerability in N-able N-central versions prior to 2026.4.1 enables privilege escalation, potentially allowing unauthorized users to gain elevated access.","supportingMedia":null},{"lang":"nl","value":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","supportingMedia":null}],"references":[{"url":"https://advisories.ncsc.nl/csaf/v2/2026/ncsc-2026-0478.json","name":"","tags":["advisory"]},{"url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-125883.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-125878.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-125879.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-125880.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-125881.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-125882.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91000.json","name":"","tags":["advisory"]}],"metrics":null,"problemTypes":[{"descriptions":[{"lang":"en","description":"Improper Restriction of XML External Entity Reference","cweId":"CWE-611","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Neutralization of Input During Web Page Generation","cweId":"CWE-79","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Incorrect Privilege Assignment","cweId":"CWE-266","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Neutralization of HTTP Headers for Scripting Syntax","cweId":"CWE-644","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Server-Side Request Forgery","cweId":"CWE-918","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Relative Path Traversal","cweId":"CWE-23","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Missing Authentication for Critical Functionality","cweId":"CWE-306","type":"CWE"}]}],"affected":[{"vendor":"N-able","product":"vers:unknown/*","collectionURL":"","packageName":"","repo":"","defaultStatus":"","versions":null,"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null,"x_vulnetix_aliases":{"direct":["CVE-2026-125878","CVE-2026-125879","CVE-2026-125880","CVE-2026-125881","CVE-2026-125882","CVE-2026-125883","CVE-2026-91000"]}},"adp":null}}