N-able releases security hotfixes for zero-day vulnerabilities - BleepingComputer
N-able has released security hotfixes to address zero-day vulnerabilities affecting its N-central remote monitoring and management platform, which were publicly disclosed over the weekend and forced the company to take vulnerable hosted environments offline.
The vulnerabilities, affecting N-central versions including 2026.4.0.31, include multiple critical flaws such as remote code execution (RCE), authentication bypasses, credential disclosure, and cross-site scripting (XSS). N-able took all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions as a precautionary measure while developing patches.
Critical vulnerabilities patched
N-able has released N-central 2026.4 HF2 with security patches addressing the most critical vulnerabilities, including CVE-2026-125883 (Multiple XXE Vulnerabilities), CVE-2026-125878 (Multiple OGNL Injection vulnerabilities), and CVE-2026-125882 (RCE via file repository upload path traversal). The company confirmed that all hosted N-central servers have been successfully upgraded across all regions.
Customers should follow the published upgrade guidance carefully before restoring normal access to their N-central environment. Earlier incident guidance advised On-Premises customers to keep their N-central servers offline while remediation was being developed.
Threats emerging
Despite N-able's statement that the flaws haven't been flagged as exploited in the wild, threat intelligence company Defused reported that attackers have already begun scanning the Internet for vulnerable systems. "During the past 24 hours, we have observed probing of N-able N-central for the 0-days that were dropped publicly yesterday," Defused said.
Shadowserver reported that approximately 148 N-central servers are currently exposed online, a significant decrease from the 1,338 detected on Monday, suggesting many administrators have taken action to secure their systems.
Researcher's disclosure
Security researcher Sean Bales disclosed the vulnerabilities on November 8 and published a GitHub repository called Able2Shell containing proof-of-concept exploits. Bales claimed he released the information without notifying N-able because the company allegedly failed to patch vulnerabilities he reported in a different N-able product five to six months ago.
The vulnerabilities include an unauthenticated XXE-to-RCE exploit chain that abuses N-central's service-import functionality to steal trusted local sessions, reset passwords, and execute commands as the nable user. Attackers could also create a Default Administrator account with attacker-controlled credentials, gaining rogue admin access to the N-central management interface.
Related
