N-able Ships N-central 2026.4 HF2 as Attackers Scan for Flaws With Public PoC Exploit Code

TL;DR

N-able released N-central 2026.4 HF2 on November 10, 2026, to fix the most critical N-central vulnerabilities disclosed by an outside researcher. The fix arrives as attackers begin probing servers. N-able says it is “now observing scanning activity associated with the published proof-of-concept code.” Seven CVEs now cover the patched flaws, with scores up to CVSS 9.3.

Full details and Python exploit scripts for the “Able2Shell” flaws went public on November 9. Attackers are now scanning for exposed N-central servers, though N-able has not confirmed successful attacks. Upgrade on-premises servers to 2026.4 HF2 before bringing them back online.

Notable CVEs

Why It Matters

N-central is a remote monitoring and management platform for managed service providers. As a result, one compromised server can reach every endpoint it manages. The public proof-of-concept code lowers the bar for attackers, and scanning is often the first step before real attacks.

So far, the activity N-able reports is scanning only. No successful exploitation has been confirmed, and none of the seven CVEs appears in CISA’s Known Exploited Vulnerabilities catalog yet. N-able also warns that “a follow-up hotfix will be released,” so this is not the last update.

How the Attack Works

Unauthenticated flaws

Two of the N-central vulnerabilities need no login and score 9.3 under CVSS 4.0. CVE-2026-125883 covers multiple XML External Entity (XXE) bugs. Meanwhile, CVE-2026-125881 is a server-side request forgery in service import schema validation.

Code execution and privilege escalation

CVE-2026-125878 (CVSS 8.7) covers multiple OGNL injection flaws that need only a low-privileged account. In addition, CVE-2026-125882 (CVSS 8.6) allows remote code execution through path traversal in the file repository upload. Nate Fair of Sprocket Security reported that bug.

Two more flaws lead to root or higher local privileges. CVE-2026-125879 abuses a syslog-ng config that the nable user can write. CVE-2026-91000 stems from insecure IPC channels. Finally, CVE-2026-125880 is a stored XSS through MMS3 patch metadata in the admin context.

Affected Versions

• N-central on-premises builds before the 2026.4 HF2 release
• N-central hosted (NCOD) instances in the Americas, APAC and Europe, now upgraded by N-able

Patch and Mitigation

Hosted customers

N-able says all hosted N-central servers across every region finished upgrading by November 11 at 01:04 UTC. No customer action is needed for the upgrade itself.

On-premises customers

N-able “strongly recommends that all N-central On-Premises customers upgrade to the newly released version as soon as possible.” Until then, it advises keeping servers offline. Legacy versions from 2020.1 to 2022.6 must first move to 2026.3. After patching, review admin accounts and file repository uploads for signs of abuse. Live progress is on the N-able status page, which will also announce the next hotfix for these N-central vulnerabilities.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.