N-able hotfixes seven N-central CVEs after Able2Shell proof-of-concept
Original title: Able2Shell: Frequently asked questions for reported N-able N-central zero-day vulnerabilities
A researcher published proof-of-concept code for 33 alleged flaws; N-able says hosted servers are upgraded and no customer compromise is confirmed.
On November 9, a researcher under the GitHub account Oracle-Security published Able2Shell, describing 33 alleged N-able N-central vulnerabilities with proof-of-concept code. The researcher says one chain runs commands without credentials. N-able released N-central 2026.4 Hotfix 2 on November 10, fixing seven CVEs scored CVSSv4 8.3 to 9.3, and said all hosted servers were upgraded. N-able reports scanning tied to the published code; Huntress had not seen partner compromises.
Unconfirmed: N-able has not mapped its seven CVEs to the 33 findings, and no confirmed customer-server compromise has been reported.
- N-able lists N-central before 26.4.1 as affected; the fixed build is 2026.4.1.26.
- The researcher tested Appliance 2026.4.0.31 and called it a pre-release build.
- CVE-2026-125883 covers multiple XXE issues and is scored 9.3.
- CVE-2026-91000 was reserved on September 14, before the public disclosure.
- Hosted customers still must upgrade their own Agents and Probes.
Impact: Alleged unauthenticated command execution and paths to root
| Product | Affected | Fixed in |
|---|---|---|
| N-able N-central | before 26.4.1 (CVE-2026-91000 record writes 2026.4.1) | 2026.4.1.26 |
- 1.Install N-central 2026.4 Hotfix 2, fixed build 2026.4.1.26.
- 2.Hosted customers should upgrade their own Agents and Probes.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125881 | Unauthenticated SSRF in N-able N-central before 26.4.1 | 9.3 group max | — |
From the original article
6 min read at tenable.com
N-able released a hotfix for N-central that fixes seven CVEs after a researcher published proof-of-concept code for 33 alleged zero-day vulnerabilities. The researcher says one attack chain needs no credentials. Key Takeaways Able2Shell is a set of 33 alleged vulnerabilities in N-able N-central, published with proof-of-concept code.
By Research Special Operations · tenable.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.