N-able releases N-central 2026.4 HF2 for publicly disclosed zero-days
Original title: N-able releases security hotfixes for zero-day vulnerabilities
Defused saw internet probing of the flaws; Shadowserver counts about 148 exposed servers, down from 1,338.
N-able took hosted N-central environments offline on November 9, 2026, after Sean Bales published proof-of-concept exploits on November 8 without vendor coordination. The company released N-central 2026.4 HF2 and said every hosted NCOD server is upgraded. It has not confirmed exploitation. Defused reported probing that opened anonymous agent sessions, pulled appliance configuration, and hit the remote-control endpoint without authentication. Bales says the bugs affect pre-release Appliance 2026.4.0.31 and likely earlier builds.
Unconfirmed: N-able has not confirmed exploitation; Bales' claims about earlier versions and ignored reports are unverified.
- Bales published a GitHub repository named Able2Shell with proof-of-concept exploits.
- His demo chains unauthenticated XXE to remote code execution as the nable user.
- The chain can reset a password and create a Default Administrator account.
- Shadowserver reported just over 148 exposed servers, down from 1,338 on Monday.
- N-able did not answer claims it ignored earlier reports in another product.
Impact: unauthenticated remote code execution and rogue administrator access
| Product | Affected | Fixed in |
|---|---|---|
| N-able N-central | Appliance 2026.4.0.31 (pre-release); researcher believes earlier versions | N-central 2026.4 HF2 |
- 1.Upgrade on-premises N-central to 2026.4 HF2 before restoring access.
- 2.Take internet-exposed N-central servers offline until patched.
- CVEs
- CVE-2026-125878CVE-2026-125879CVE-2026-125880CVE-2026-125881CVE-2026-125882CVE-2026-125883CVE-2026-91000
- Vendors
- N-able
- Products
- N-central
- Organizations
- DefusedShadowserverSprocket Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125881 | Unauthenticated SSRF in N-able N-central before 26.4.1 | 9.3 group max | — |
From the original article
3 min read at bleepingcomputer.com
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.