N-able ships N-central emergency fix after 33 exploits published
Original title: N-able N-central gets emergency fix two days after 33 exploits published
Hosted N-central was taken offline worldwide, and on-premises customers were told to shut servers down until 2026.4 HF2.
N-able took hosted N-central offline worldwide and released N-central 2026.4 HF2 after researcher Sean Bales published 33 proof-of-concept exploits, dubbed Able2Shell. The chains include unauthenticated paths to command execution as the nable service account and, in some cases, root. N-able reported scanning tied to the exploits but no confirmed compromise of a customer environment. On-premises customers had been told to shut servers down until the hotfix.
Unconfirmed: N-able says it has seen no successful compromise of a customer environment and has not confirmed how many of the 33 flaws it reproduced.
- Censys found 1,728 internet-exposed N-central instances.
- Previdian recorded 68 honeypot exploitation attempts from one IP within about 18 hours.
- The hotfix lists seven CVEs; N-able has not said how many of 33 it reproduced.
- Bales tested the chains on pre-release N-central Appliance 2026.4.0.31.
- Huntress said patched servers may not display a new version number.
Impact: Unauthenticated remote command execution as the nable user or root.
| Product | Affected | Fixed in |
|---|---|---|
| N-able N-central | Appliance 2026.4.0.31 and previous versions, including the then most up-to-date release | N-central 2026.4 HF2 |
- 1.Upgrade on-premises servers to N-central 2026.4 Hotfix 2 and update Agents and Probes.
- 2.Review authentication activity from November 8 for unexpected administrator accounts and sessions.
- 3.Preserve logs and snapshots, then rotate administrator, technician, and agent credentials.
- CVEs
- CVE-2026-125883CVE-2026-125878CVE-2026-125879CVE-2026-125880CVE-2026-125881CVE-2026-125882CVE-2026-91000
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125881 | Unauthenticated SSRF in N-able N-central before 26.4.1 | 9.3 group max | — |
From the original article
4 min read at csoonline.com
N-able has taken its hosted N-central remote monitoring and management (RMM) platform offline worldwide and shipped an emergency hotfix after a security researcher released 33 zero-day exploits for the software, including attack chains that could let unauthenticated attackers take over servers.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.