N-able ships N-central hotfix after 33 Able2Shell flaws go public
Build 2026.4.1.26 patches seven CVEs and disables remote control, while proof-of-concept code for all 33 issues stays public.
80
Organization
Sprocket Security
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenNov 11, 2026
- Last mentioned3h ago
Timeline
3 articles · newest firstN-able warns of scanning for critical N-central flaws after public PoC
Hotfix 2, build 2026.4.1.26, covers seven CVEs, including path-traversal remote code execution CVE-2026-125882.
80
N-able releases N-central 2026.4 HF2 for publicly disclosed zero-days
Defused saw internet probing of the flaws; Shadowserver counts about 148 exposed servers, down from 1,338.
80
Related CVEs
by mentions- XXE schema poisoning in N-able N-central before 26.4.1
- Unauthenticated SSRF in N-able N-central before 26.4.1
- Authenticated XSS in N-able N-central before 26.4.1
- Relative path traversal in N-able N-central before 26.4.1
- Incorrect privilege assignment in N-able N-central before 26.4.1
- Missing-auth privilege escalation in N-able N-central before 2026.4.1
- HTTP header XSS in N-able N-central before 26.4.1
Appears with
- N-centralproduct · 3
- N-ablevendor · 3
- Beazley Securityorganization · 1
- Shadowserverorganization · 1
- Defusedorganization · 1
- WatchTowrorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.