Editorial Team
6 min read
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
N-able, a provider of remote monitoring, cybersecurity and data protection tools for IT departments and managed service providers, says its N-central 2026.4 HF2 hotfix addresses all identified vulnerabilities exploitable without authentication. Its hosted N-central servers are back online, but more fixes are planned. Customers running their own servers are being told to keep them inaccessible from the internet until they complete the upgrade.
N-central is its remote monitoring and management platform, centralizing control of client networks and devices in a web console. Managed service providers use it to administer other organizations’ systems, so a compromised management server can put downstream customers at risk. Public exploit code demonstrated a route from unauthenticated access to server commands and a new administrator account, according to a report on the disclosure and response.
Tenable Research Special Operations’ Able2Shell FAQ covers the N-central vulnerability disclosure. Source: Tenable.
N-able took hosted N-central environments offline across the Americas, Europe and Asia-Pacific on November 9 after public disclosure of vulnerabilities and exploit code, the company said in a statement describing its precautionary shutdown. It released HF2 on November 10, and says hosted servers have now been upgraded and restored.
In its security update, N-able says it prioritized severity and exploitability rather than keeping customers offline until every issue could be fixed. The remaining vulnerabilities require an authenticated N-central account, often with elevated privileges, or other conditions that limit exploitability, the company says. Those issues are slated for subsequent hotfixes.
The release notes identify the fixed server build as 2026.4.1.26, superseding both the original 2026.4 release and Hotfix 1, and list seven CVEs. NHS England’s November 11 alert classifies two as critical and five as high severity, and lists versions before 2026.4 HF2 as affected. The two critical entries, CVE-2026-125881 and CVE-2026-125883, each carry a CVSSv4 score of 9.3.
The seven identifiers are not a simple tally of how much of the original disclosure has been repaired. Offensive security researcher Sean Bales, who published the findings as Able2Shell, described 33 alleged flaws, some of which form steps within four longer exploit chains, according to the technical reporting. Tenable’s Research Special Operations team says in its November 11 analysis that N-able has not individually mapped its CVEs to those 33 findings. Subtracting seven from 33 would therefore not establish the number of unresolved vulnerabilities. The release notes also credit one fix, CVE-2026-125882, to a different researcher, Nate Fair of Sprocket Security.
The chains have different prerequisites and outcomes. Tenable says the service-import XML external entity (XXE) chain needs no login and reaches command execution as the server’s nable account. Two other chains allow an unauthenticated attacker to plant a script but require a logged-in administrator to view poisoned patch details. One of those reaches root, the highest-privilege account; another root-level chain requires a login.
HF2 strengthens authentication, permissions, file handling and server components, removes legacy mobile device management, and changes Agent-to-Probe communication. N-able’s built-in remote-control function remains temporarily disabled, although the separate Take Control feature continues working, according to the release notes.
The division of responsibility matters. N-able upgrades hosted servers; on-premises customers upgrade their own. Both groups must upgrade Agents and Probes themselves. A completed hosted-server upgrade therefore does not finish the customer’s deployment work.
N-able instructs customers to upgrade Agents before Probes. Once a Probe reaches version 2026.4.1.26 or later, it cannot communicate with an Agent unless both that Agent and the Patch Management Engine are also at 2026.4.1.26 or later. Incompatible versions interrupt dependent functions such as the offline patch cache. The updated Patch Management Engine is delivered separately and automatically. Updated Agents and the engine remain compatible with older Probes, allowing upgrades in stages.
Older server installations can require an intermediate upgrade: the release notes support direct upgrades from the listed 2025.4 and later releases, while earlier versions must first move to a supported version.
Company-reported upgrade guidance from N-able for HF2 build 2026.4.1.26. Earlier installations require an intermediate upgrade. Source: N-able Status.
N-able says it is observing scanning associated with the published proof-of-concept code but has seen no indications of compromise within its hosted N-central servers. NHS England’s alert separately says researchers have observed exploitation attempts and assesses further exploitation as likely. Attempts do not, by themselves, establish successful compromise.
A November 11 report citing Shadowserver measurements put publicly exposed N-central servers at just over 148, down from 1,338 detected on Monday, November 9. That measures visible servers, not affected endpoints or compromised organizations. It does not establish how many installations were patched rather than taken offline.
The concern extends beyond the management server. Bales demonstrated how the service-import chain could steal a trusted local session, reset the target account’s password, execute commands as the nable user and create an administrator account, according to the same reporting. He said testing used the prerelease N-central Appliance 2026.4.0.31 and believed most or all findings would affect earlier versions.
N-central also has a history of exploitation. Tenable lists five earlier N-central CVEs in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog as of November 10: two added in August 2025, two in August 2026 and one in September 2026. None of the seven HF2 CVEs was in that catalog at that point, its analysis says.
The technical reporting describes an August 2026 authentication-bypass incident in which attackers circumvented an initial fix. In that incident, attackers gained administrative access and used Take Control to reach managed systems. Those earlier incidents illustrate the downstream stakes; they do not prove that the newly disclosed flaws have produced the same outcome.
Shadowserver measurements show fewer publicly visible N-central servers. The counts do not establish how many were patched, taken offline or compromised. Source: BleepingComputer.
Bales said he released the N-central findings without notifying N-able because it had allegedly failed to patch different vulnerabilities—including two unrelated remote-code-execution bugs and a privilege-escalation flaw—he reported in another N-able product five to six months earlier, according to the account of his explanation. The report says N-able did not answer questions about those earlier allegations, instead providing a statement about the current incident.
N-able now rejects claims that it ignored responsible disclosure, saying the new findings published on November 9 did not come through its established reporting channels. It points to those channels, including an active bug bounty program. Its statement about the new findings does not resolve Bales’s separate allegation about earlier reports involving another product.
N-able promises further security updates but gives no release date in its security update. The outstanding questions include which remaining findings those updates address and when built-in remote control will return.
Customers also need to investigate their environments. N-able says an individual environment needs its own assessment. Huntress researchers, cited in the incident reporting, advise reviewing login and authentication activity from November 8 onward and checking audit logs for anomalous remote sessions or newly deployed scripts. Unexpected or unauthorized access should trigger incident-response involvement, they say.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.