CVE-2025-11700: high-severity vulnerability in N-able N-central
N-central Multiple XXE Injection Vulnerabilities
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8.4epss 32%
from disclosure to weapon2 days
Published on NVDNov 12
1st PoC+2d
metasploit+5d
VulnCheck+33d
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L
Affected products
N-able · N-centralpublic PoCs found — 1
vulncheckvulncheck.com/xdb/685f9ef57d2bunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — N-able N-central
In the same product, most dangerous first.
CVE-2026-86218CRITICALpre-authentication remote code executionEPSS 15.4%KEVCVE-2026-18577HIGHIncomplete patch leads to administrative account takeoverEPSS 14.6%KEVCVE-2026-18556HIGHUnauthenticated administrative account takeoverEPSS 7.9%KEVCVE-2025-8876CRITICALCommand Injection VulnerabilityEPSS 4.1%KEVCVE-2025-8875CRITICALInsecure Deserialization VulnerabilityEPSS 2.3%KEVCVE-2025-9316MEDIUMN-central unauthenticated sessionID generationEPSS 37.4%