N-able releases security hotfixes for zero-day vulnerabilities
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline.
This follows N-able’s decision to take all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions until it could patch them against potential attacks targeting the zero-day flaws in the wild.
“N-able is actively responding to non-responsible communication of critical vulnerabilities in N-central late Sunday night, November 8, found by an independent researcher,” N-able told GeekFeed on Monday. “As a precautionary measure, we took our Hosted N-central environment offline today, November 9, and provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice.”
N-central lets IT departments and managed service providers (MSPs) monitor, manage, and maintain client networks and devices from a centralized web-based console.
N-able has now released N-central 2026.4 HF2 with security patches and technology updates for some of the leaked zero-days, including “the most critical” vulnerabilities:
- CVE-2026-125883 – Multiple XXE Vulnerabilities
- CVE-2026-125878 – Multiple OGNL Injection vulnerabilities
- CVE-2026-125879 – Local privilege escalation to root via nable-writable syslog-ng config
- CVE-2026-125880 – Stored XSS via MMS3 patch metadata (admin context)
- CVE-2026-125881 – Schema-hint SSRF via service import schema validation
- CVE-2026-125882 – RCE via file repository upload path traversal (Credit Nate Fair, Sprocket Security)
- CVE-2026-91000 – Insecure IPC Channels lead to local privilege escalation
In a Tuesday update, N-able said that all hosted N-central servers (NCODs) across all regions have now been successfully upgraded and advised and “strongly” recommended that all N-central On-Premises customers upgrade their installations to the newly released version “as soon as possible.”
“Customers should follow the published upgrade guidance carefully before restoring normal access to their N-central environment. Earlier incident guidance advised On-Premises customers to keep their N-central servers offline while remediation was being developed,” it said.
While N-able has yet to flag these flaws as exploited in the wild, threat intelligence company Defused said on Tuesday that attackers have already started scanning the Internet for vulnerable systems and warned admins to take N-central servers offline immediately.
“During the past 24 hours, we have observed probing of N-able N-central for the 0-days that were dropped publicly yesterday,” Defused said. “We have seen opening of anonymous agent sessions, pulling appliance config and hitting the remote control endpoint without auth. These pathways are part of the 0-day exploit surface.”
Internet security nonprofit Shadowserver reports that just over 148 N-central servers are currently exposed online, a sharp decrease from the 1,338 it detected on Monday.
Disclosed after previous reports were allegedly ignored
Security researcher Sean Bales disclosed the vulnerabilities late Sunday, November 8, and published a GitHub repository called Able2Shell containing proof-of-concept exploits for the flaws.
Bales said the zero-day bugs affect N-central Appliance 2026.4.0.31, a pre-release version of the software, and believes that most (if not all) of the flaws also affect earlier versions.
The disclosed vulnerabilities include remote code execution (RCE), authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, XML external entity (XXE) injection, and cross-site scripting (XSS) flaws.
The security researcher also demoed a critical unauthenticated XXE-to-RCE exploit chain that abuses N-central’s service-import functionality to steal a trusted local session, reset the targeted account’s password, and execute commands on the server as the nable user.
Attackers could also use this exploit to create a Default Administrator account with attacker-controlled credentials, which provides them rogue admin access to the N-central management interface, as shown in the video demo embedded below.
Bales told GeekFeed that he released the N-central zero-days without notifying N-able because the company allegedly failed to patch vulnerabilities (including two unrelated remote code execution bugs and a privilege-escalation flaw) he reported in a different N-able product about five to six months ago.
“Claims that N-able ignored responsible disclosure from the researcher are inaccurate. The new vulnerabilities that the researcher published on November 9 were not responsibly disclosed through our established reporting channels,” N-able said when asked about Bales’ allegations regarding the previously disclosed security issues.
“We have released N-central 2026.4 HF2 to address the critical security updates. Hosted environments have been upgraded and are back online, and on-premises customers have been guided to apply the hotfix as soon as possible before restoring internet access.”
N-able provides cloud-based remote monitoring, cybersecurity, and data protection tools for Managed Service Providers (MSPs) and enterprise IT departments at more than 500,000 organizations in over 140 countries.
