N-able ships N-central hotfix after 33 Able2Shell flaws go public
Original title: N-able Rushes Out N-central Fixes After 33 Zero-Days Go Public
Build 2026.4.1.26 patches seven CVEs and disables remote control, while proof-of-concept code for all 33 issues stays public.
Researcher Sean Bales published Able2Shell on November 9, describing 33 alleged N-central zero-days and four exploit chains he said reach code execution, two as root and one without credentials. N-able took hosted servers offline, then issued 2026.4 Hotfix 2 covering seven CVEs: XXE, OGNL injection, privilege escalation, stored XSS, SSRF and path-traversal remote code execution, and it turns off built-in remote control. Hosted environments are back online. N-able reports scanning tied to the PoCs; WatchTowr saw attempts against honeypots, not customer systems.
Unconfirmed: N-able has not mapped the seven patched CVEs to the 33 published issues, and exploitation of customer systems is not confirmed.
- Hotfix build is 2026.4.1.26; remote control returns in a later fix.
- CVE-2026-125882 is credited to Nate Fair of Sprocket Security.
- Bales said he never reported the flaws through N-able's channels.
- Customers must update agents and probes after the server upgrade.
- A follow-up hotfix is planned for remaining November 9 issues.
Impact: Code execution on N-central servers, including as root
| Product | Affected | Fixed in |
|---|---|---|
| N-able N-central | Pre-release build tested; Bales said earlier versions including the current release | 2026.4 Hotfix 2, build 2026.4.1.26 |
- 1.Install N-central 2026.4 Hotfix 2, build 2026.4.1.26.
- 2.Keep on-premises N-central servers offline until they are updated.
- 3.Update agents and probes after upgrading the server.
- CVEs
- CVE-2026-125883CVE-2026-125878CVE-2026-125879CVE-2026-125880CVE-2026-125881CVE-2026-125882CVE-2026-91000
- Vendors
- N-able
- Products
- N-central
- Organizations
- WatchTowrBeazley SecuritySprocket Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125881 | Unauthenticated SSRF in N-able N-central before 26.4.1 | 9.3 group max | — |
From the original article
2 min read at infosecurity-magazine.com
N-able fixes seven N-central CVEs after 33 alleged zero-days are published
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.