N-able has released N-central 2026.4 Hotfix 2 after a researcher published exploit code for more than 30 alleged zero-day flaws in the remote monitoring platform. N-able says it has already upgraded every hosted server, but customers who run N-central on their own servers must install the update themselves. N-central is widely used by managed service providers (MSPs), so a compromised server can become a path into many client networks.
What happened
Application security consultant Sean Bales published a GitHub repository called Able2Shell, with proof-of-concept exploits for N-central, around Nov. 8–9 (sources differ on the exact timing). Field Effect and GovInfoSecurity both count 33 alleged flaws. BleepingComputer says they include remote code execution, authentication bypass, credential disclosure and arbitrary file writes, plus an unauthenticated chain that can end in code execution and the creation of a rogue administrator account.
Bales told BleepingComputer he skipped coordinated disclosure because N-able had allegedly left earlier reports on a different product unpatched for five to six months. N-able did not address that allegation when asked. Bales says he tested a pre-release build (2026.4.0.31) and believes most or all of the flaws also affect earlier versions.
On Monday, Nov. 9, N-able took its hosted N-central environment offline and told on-premises customers to do the same, citing “non-responsible communication of critical vulnerabilities.” It said then that it had not seen active exploitation. On Tuesday, Nov. 10, it published N-central 2026.4 HF2 (build 2026.4.1.26). The release notes list seven CVEs, CVE-2026-125878 through CVE-2026-125883 and CVE-2026-91000, and describe wider hardening of authentication, file upload handling and agent-to-probe communication. BleepingComputer says N-able reported all hosted servers upgraded by Tuesday.
Why it matters
An RMM server holds trusted access to the systems it manages, so taking it over can mean software deployment, script execution and remote control across many endpoints. N-central has been a repeat target this year. Field Effect notes an authentication bypass (CVE-2026-18577) exploited in July and August, and a pre-authentication flaw (CVE-2026-86218) that CISA added to its Known Exploited Vulnerabilities catalog. GovInfoSecurity counted this fix as the fifth emergency hotfix since Aug. 1. BleepingComputer reports N-able’s products reach more than 500,000 organizations in over 140 countries.
BleepingComputer said N-able had not yet flagged the new flaws as exploited. But threat-intelligence firm Defused said on Tuesday it had seen probing for the leaked bugs, including anonymous agent sessions, appliance configuration pulls and unauthenticated requests to the remote-control endpoint. Shadowserver counted just over 148 internet-exposed N-central servers in that Nov. 11 report, down from 1,338 on Monday.
What to do
From N-able’s release notes:
- On-premises: upgrade the server to 2026.4.1.26 as soon as possible. Direct upgrades are supported from 2025.4 and later builds; older versions must first move to a supported one.
- Hosted and on-premises: upgrade Agents and Probes as well, Agents first, then Probes. Mismatched versions can break agent-to-probe communication, including the offline patch cache.
- Follow N-able’s published upgrade guidance before restoring normal access to the server. Built-in remote control is temporarily disabled; Take Control still works.
Our analysis, not N-able’s guidance:
- Keep the console off the public internet and limit it to an admin VPN or allowlist. BleepingComputer describes HF2 as covering some of the leaked flaws, so assume the exposure is not fully closed.
- Review activity since Nov. 8 for unfamiliar administrators (including a Default Administrator account), unexpected scripts, software deployments and remote-control sessions. Field Effect advises looking closely at the period just before servers went offline.
- If anything looks wrong, rotate credentials stored in or used by N-central and check what it can reach, such as domain controllers, backups and hypervisors.
- MSPs should tell clients what is known now and plan for further hotfixes.
What we still do not know
- Whether HF2 closes all 33 alleged flaws. We found no public mapping from N-able’s seven named CVEs to every published exploit.
- Whether any server has been compromised. N-able has not reported exploitation, and Defused described probing only.
- Whether older releases are affected, as Bales claims.
- How N-able will respond to Bales’s claims about his earlier reports.
Sources: BleepingComputer, Nov. 11, 2026; N-able Status, N-central 2026.4 HF2 Release Notes, Nov. 10, 2026; GovInfoSecurity, Nov. 9, 2026; Field Effect, Nov. 9, 2026.
Leave a Reply