N-able Warns of Critical N-central Zero-Day Vulnerability Actively Exploited by Hackers - GBHackers News
N-able has warned that attackers are actively scanning for vulnerable N-central servers after proof-of-concept code for critical flaws was published.
N-able has declared a major outage incident on November 9, 2026, following the publication of proof-of-concept code related to critical flaws in its remote monitoring and management (RMM) platform. The company has noted increased scanning activity by attackers targeting vulnerable N-central servers.
Critical Flaws Identified
N-able has released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) addressing seven CVEs. The most serious is CVE-2026-125882, a remote code execution flaw caused by path traversal in the file repository upload function, credited to Nate Fair of Sprocket Security.
The other vulnerabilities include multiple XXE flaws, OGNL injection bugs, a stored XSS issue, an SSRF issue, and two local privilege escalation paths. N-able also mentioned that a follow-up hotfix will deliver additional security updates.
Customer Response Required
The built-in remote control is temporarily disabled, though Take Control still works.
N-able confirmed that all hosted N-central servers have been upgraded by November 11, 2026. On-premises customers must upgrade themselves, with supported paths from various 2025-2026 versions. Both hosted and on-premises customers must also upgrade Agents and Probes in the correct order.
Related
