N-able releases N-central hotfix for leaked zero-day flaws

N-able released N-central 2026.4 HF2 on Tuesday, a security hotfix for zero-day vulnerabilities that forced the company to take its hosted remote monitoring and management platform offline, BleepingComputer reported. The update patches seven CVEs that N-able called the most critical of the leaked bugs: CVE-2026-125883 for multiple XXE vulnerabilities, CVE-2026-125878 for multiple OGNL injection flaws, CVE-2026-125879 for local privilege escalation to root via a writable syslog-ng config, CVE-2026-125880 for stored XSS in MMS3 patch metadata, CVE-2026-125881 for schema-hint SSRF, CVE-2026-125882 for remote code execution via file repository upload path traversal, and CVE-2026-91000 for insecure IPC channels leading to local privilege escalation.

N-central allows IT teams and managed service providers to oversee, control, and upkeep client networks from one web-based console, BleepingComputer reported. Bales tested the flaws on N-central Appliance 2026.4.0.31, a pre-release build, and said most or all likely affect earlier versions as well. BleepingComputer reported that the flaws include remote code execution, authentication bypass, credential disclosure, arbitrary file writes, directory traversal, XXE injection, and cross-site scripting.

After Bales published the exploits, N-able took its hosted N-central environments offline in the Americas, Europe, and Asia-Pacific on Monday, BleepingComputer reported. In a Monday statement, the company said it was "actively responding to non-responsible communication of critical vulnerabilities in N-central late Sunday night, November 8, found by an independent researcher." BleepingComputer reported In a Tuesday update, N-able said every hosted N-central server across all regions had been upgraded and it strongly advised on-premises customers to upgrade to the new version "as soon as possible." N-able said Customers should follow the published upgrade guidance before restoring access; earlier guidance had told on-premises customers to keep servers offline until further notice.

N-able has not said the flaws are exploited in the wild, but threat intelligence firm Defused reported Tuesday that it detected probing of N-central for the zero-days over the prior 24 hours, including anonymous agent session creation, appliance config retrieval, and unauthenticated access to the remote control endpoint. BleepingComputer reported BleepingComputer cited Shadowserver, which counted just over 148 N-central servers exposed online, down from 1,338 on Monday.

Sean Bales disclosed the vulnerabilities late Sunday and published a GitHub repository called Able2Shell with proof-of-concept exploits. BleepingComputer reported that he demonstrated an unauthenticated XXE-to-RCE chain that steals a trusted local session, resets a password, and executes commands as the nable user, and can create a Default Administrator account. Huntress said the disclosure included 33 critical vulnerabilities that can be combined into four exploit scenarios, and N-able had seen no active exploitation as of 15:15 UTC on November 9, Five Nines reported on Tuesday. Bales told BleepingComputer he skipped notifying N-able because he says the company left unpatched two separate RCE bugs and a privilege escalation flaw he had reported in another N-able product five to six months earlier. N-able did not address those allegations and instead sent a statement about the N-central incident. BleepingComputer reported

On-premises administrators should keep servers offline until they can upgrade to 2026.4 HF2 and then follow the published upgrade guidance before restoring access. N-able advised