N-able patches N-central zero-days as attackers probe exposed servers
Original title: Hackers Target N-central Zero-Days as N-able Rushes Patches
N-central 2026.4 HF2 fixes the unauthenticated bugs; N-able says hosted servers show scanning but no compromise.
Researcher Sean Bales published details and proof-of-concept code for more than 30 N-central flaws he calls Able2Shell. N-able briefly took hosted environments offline, then restored them after patching the higher-severity bugs, including every flaw exploitable without authentication. On-premises customers are told to install N-central 2026.4 HF2 because attackers are probing exposed instances with the public PoC. Remaining bugs need an authenticated, often privileged, account.
Unconfirmed: N-able reports no compromise of hosted servers and disputes that Bales used its disclosure channels.
- Fixed issues include CVE-2026-125883 and CVE-2026-125881, both scored 9.3.
- CVE-2026-91000 is missing authentication leading to privilege escalation, scored 8.4.
- Nate Fair of Sprocket Security reported path-traversal-to-RCE CVE-2026-125882, scored 8.6.
- Defused saw anonymous agent sessions, config pulls, and unauthenticated remote-control requests.
Impact: Unauthenticated access, XXE, SSRF, XSS, and path traversal to RCE
| Product | Affected | Fixed in |
|---|---|---|
| N-able N-central | — | 2026.4 HF2 |
- 1.Update on-premises N-central deployments to 2026.4 HF2 as soon as possible.
- 2.Treat exposed on-premises instances as already being probed with the public proof of concept.
- CVEs
- CVE-2026-125883CVE-2026-125878CVE-2026-125879CVE-2026-125880CVE-2026-125881CVE-2026-91000CVE-2026-125882
- Vendors
- N-able
- Products
- N-central
- Organizations
- Sprocket SecurityDefused
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125881 | Unauthenticated SSRF in N-able N-central before 26.4.1 | 9.3 group max | — |
From the original article
2 min read at securityweek.com
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones. The post Hackers Target N-central Zero-Days as N-able Rushes Patches appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.