Hackers Target N-central Zero-Days as N-able Rushes Patches
N-able has rolled out patches for multiple zero-day vulnerabilities in its N-central platform after a researcher published details and proof-of-concept code over the weekend, with attackers already exploiting some of the flaws.
The vulnerabilities, which Bales named Able2Shell, include critical issues such as CVE-2026-125883 (XXE issues, CVSS 9.3), CVE-2026-125881 (SSRF, CVSS 9.3), and CVE-2026-125878 (XSS flaws, CVSS 8.7). N-able took its hosted environments offline on Monday to investigate and develop fixes, urging customers to disconnect on-premises deployments as well.
Critical Vulnerabilities Addressed
N-able has resolved all vulnerabilities that could be exploited without authentication, prioritizing fixes based on severity and exploitability. The update N-central 2026.4 HF2 includes patches for these critical flaws, though some reported by Nate Fair of Sprocket Security were also addressed.
The remaining vulnerabilities require an authenticated N-central account often with elevated privileges, or additional conditions that limit exploitability, and will be addressed through subsequent hotfixes as we continue to prioritize the security and protection of our customers.
Active Exploitation Detected
Publishing exploit code before customers have had the chance to act doesn't make anyone safer. It hands attackers a head start. This is a moment for our industry to recommit to putting customers first and honoring that duty to protect.
Cybersecurity firms report attackers are already probing exposed systems. Defused observed scanning activity starting Monday, with "opening of anonymous agent sessions, pulling appliance config and hitting the remote-control endpoint without auth." N-able confirms it has seen "scanning activity associated with the publicly released proof-of-concept code" but no compromise of hosted servers.
Related
