N-able ships hotfix for seven N-central zero-days after full disclosure

N-able released N-central 2026.4 HF2 on November 10 to patch seven zero-day vulnerabilities, one day after pulling every hosted instance of its RMM platform offline across the Americas, Europe, and Asia-Pacific.

The bugs were not found quietly. Researcher Sean Bales published a GitHub repository called Able2Shell on Sunday, November 8, containing working proof-of-concept exploits. He says he never told N-able first, and he gave a reason: the company allegedly ignored vulnerabilities he reported in a different N-able product five to six months ago, including two remote code execution bugs and a privilege-escalation flaw.

N-able did not answer questions about those allegations. Asked directly, the company responded with a statement about the N-central incident instead. That silence is the caveat behind every promise of faster remediation this week.

What did N-able shut down, and when?

The company acted within hours of disclosure. It took the hosted N-central environment offline on Monday, November 9, and told on-premises customers to power down their own servers until patches existed.

"N-able is actively responding to non-responsible communication of critical vulnerabilities in N-central late Sunday night, November 8, found by an independent researcher," the vendor told BleepingComputer on Monday. "As a precautionary measure, we took our Hosted N-central environment offline today, November 9, and provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice."

That is an unusual move for an RMM vendor. N-central is the console through which MSPs and enterprise IT departments monitor and manage client networks and devices. An RMM compromise is a supply-chain problem, not a single-tenant one.

What does the hotfix actually cover?

Version 2026.4 HF2 patches what N-able calls "the most critical" of the leaked flaws — note the qualifier, which implies the list is not complete:

• CVE-2026-125883 — multiple XXE vulnerabilities
• CVE-2026-125878 — multiple OGNL injection vulnerabilities
• CVE-2026-125879 — local privilege escalation to root via a nable-writable syslog-ng config
• CVE-2026-125880 — stored XSS via MMS3 patch metadata in the admin context
• CVE-2026-125881 — schema-hint SSRF via service import schema validation
• CVE-2026-125882 — RCE via file repository upload path traversal, credited to Nate Fair of Sprocket Security
• CVE-2026-91000 — insecure IPC channels leading to local privilege escalation

In a Tuesday update, N-able said all hosted N-central servers (NCODs) in every region have been upgraded. It "strongly" recommended that on-premises customers upgrade "as soon as possible" and follow published upgrade guidance before restoring normal access.

The patch targets N-central Appliance 2026.4.0.31, a pre-release version. Bales believes most, if not all, of the flaws also affect earlier releases. N-able has not confirmed that scope.

Are attackers already using the exploits?

Probably, yes. N-able has not flagged the flaws as exploited in the wild. Threat intelligence firm Defused contradicts that caution with observed traffic.

"During the past 24 hours, we have observed probing of N-able N-central for the 0-days that were dropped publicly yesterday," Defused said Tuesday. "We have seen opening of anonymous agent sessions, pulling appliance config and hitting the remote control endpoint without auth. These pathways are part of the 0-day exploit surface."

Shadowserver, the internet security nonprofit, counted just over 148 exposed N-central servers as of Tuesday. That is down sharply from 1,338 on Monday — a roughly 89 percent drop, which suggests admins did take the shutdown advice seriously.

How bad is the exploit chain?

The disclosed flaws include remote code execution, authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, XXE injection, and XSS. Bales demonstrated a critical unauthenticated XXE-to-RCE chain that abuses N-central's service-import functionality. It steals a trusted local session, resets the target account's password, and executes commands on the server as the nable user.

One variant goes further. The same chain can create a Default Administrator account with attacker-controlled credentials, granting rogue admin access to the N-central management interface. Bales published a video demo.

What should CIOs and MSPs do now?

Three concrete steps follow from the vendor's own guidance. Upgrade on-premises installations to 2026.4 HF2 immediately. Review upgrade documentation before restoring access, because earlier incident guidance instructed the opposite — keep servers down. And audit for the indicators Defused described: anonymous agent sessions, appliance config pulls, and unauthenticated hits on the remote control endpoint.

N-able says its tools serve more than 500,000 organizations across 140 countries. The attack surface is therefore broad, and the remaining unknown is how many customers run unpatched on-premises servers that never went offline at all.