GCVE-110-NCSC-2026-478

Advisory Published

Vulnetix · Advisory published November 11, 2026

N-able N-central versions prior to 26.4.1 contain a vulnerability involving improper restriction of XML external entity references, resulting in XML Schema Poisoning.

Download JSON Look up in the Resolve Platform

Weaknesses (CWE)

CWE-611Improper Restriction of XML External Entity ReferenceCWE-79Improper Neutralization of Input During Web Page GenerationCWE-266Incorrect Privilege AssignmentCWE-644Improper Neutralization of HTTP Headers for Scripting SyntaxCWE-918Server-Side Request ForgeryCWE-23Relative Path TraversalCWE-306Missing Authentication for Critical Functionality

Affected Products

Vendor	Product	Versions	Platforms
N-able	vers:unknown/*	—	—

Aliases

CVE-2026-125878 CVE-2026-125879 CVE-2026-125880 CVE-2026-125881 CVE-2026-125882 CVE-2026-125883 CVE-2026-91000

References

advisory

Browse GCVE Records

851 records in the GCVE database · Updated November 12, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Look up in the Resolve Platform Download JSON