N-able warns of scanning for critical N-central flaws after public PoC
Original title: N-able Warns of Critical N-central Zero-Day Vulnerability Actively Exploited by Hackers
Hotfix 2, build 2026.4.1.26, covers seven CVEs, including path-traversal remote code execution CVE-2026-125882.
N-able said attackers are scanning for N-central servers after proof-of-concept code for critical flaws in its RMM platform was published without the vendor. The company called the disclosure non-responsible, took hosted environments offline on November 9, 2026, and told on-premises customers to stay offline until they upgrade. On November 11 it confirmed every hosted NCOD server had been upgraded to N-central 2026.4 Hotfix 2. On-premises administrators must apply that build themselves and then update Agents before Probes.
Unconfirmed: The report describes scanning after a public PoC, not confirmed compromise of these flaws.
- N-able declared a major outage incident on November 9, 2026.
- CVE-2026-125882 is remote code execution via file-repository path traversal.
- Direct upgrades are supported from 2025.4 through 2026.4 Hotfix 1.
- A Probe on 2026.4.1.26 cannot talk to Agents that are not upgraded.
- Built-in remote control is temporarily disabled; Take Control still works.
Impact: remote code execution via file-repository path traversal
| Product | Affected | Fixed in |
|---|---|---|
| N-able N-central | — | 2026.4 Hotfix 2 (build 2026.4.1.26) |
- 1.Keep on-premises N-central servers offline until the hotfix is installed.
- 2.Upgrade to N-central 2026.4 Hotfix 2, build 2026.4.1.26.
- 3.Upgrade Agents before Probes so management features keep working.
- CVEs
- CVE-2026-125878CVE-2026-125879CVE-2026-125880CVE-2026-125881CVE-2026-125882CVE-2026-125883CVE-2026-91000
- Vendors
- N-able
- Products
- N-central
- Organizations
- Sprocket Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125881 | Unauthenticated SSRF in N-able N-central before 26.4.1 | 9.3 group max | — |
From the original article
2 min read at gbhackers.com
N-able has warned that attackers are actively scanning for vulnerable N-central servers after the publication of proof-of-concept (PoC) code related to critical flaws in its remote monitoring and management (RMM) platform. The company declared a major outage incident on November 9, 2026, and has noted increased scanning activity associated with the released PoC code. This […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.