Executive Summary
A significant research disclosure by Oracle-Security identifies over 30 vulnerabilities in the N-able N-central Appliance, specifically targeting version 2026.4.0.31 and earlier. The most critical findings describe unauthenticated exploit chains that combine XML External Entity (XXE) vulnerabilities, local session trust confusion, and improper authentication to achieve Remote Code Execution (RCE) with 'nable' or 'root' privileges.
The attack surface includes several legacy and pre-authentication SOAP endpoints, such as ServerMMS2 and ServerUI. Attackers can bypass UI session enforcement to stage malicious JSP files, reset administrative passwords via NCI local-session trust confusion, and execute arbitrary commands. Other identified risks include OGNL expression injection, stack overflows in GenericTCP handling, and mass disclosure of customer credentials and system configurations.
These vulnerabilities represent a high risk to Managed Service Providers (MSPs) who utilize N-central for IT management. Successful exploitation allows complete appliance takeover, cross-customer data disclosure, and potential downstream impact on managed client environments. At the time of the report, these vulnerabilities were characterized as unpatched zero-days.
Key Details
Threat Name
N-Able N-Central XXE to RCE
Affects
—
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified