N-able N-central gets emergency fix two days after 33 exploits published

N-able has taken its hosted N-central remote monitoring and management (RMM) platform offline worldwide and shipped an emergency hotfix after a security researcher released 33 zero-day exploits for the software, including attack chains that could let unauthenticated attackers take over servers. N-central is used by managed service providers (MSPs) and enterprise IT teams to remotely manage, patch, and support endpoint systems, so a compromised server can expose every computer under its control. N-able said it took the hosted environments offline as a precaution and advised customers using the on-premises version to shut down their servers until it released the fix, N-central 2026.4 HF2, on Tuesday. The vulnerabilities were disclosed late Sunday by an offensive security researcher named Sean Bales who uses the GitHub handle Oracle-Security. The release includes proof-of-concept exploit chains that require no authentication and could result in command execution as the service account and, in some cases, root access. N-able said it has already observed scanning activity associated with the published exploits but has not seen evidence that any customer environment has been successfully exploited. Censys found 1,728 internet-exposed N-central instances, and security firm Previdian recorded 68 exploitation attempts against one of its honeypots from a single IP address within about 18 hours of the publication. Exploit chains lead to remote code execution The 33 exploits, which the researcher dubbed Able2Shell, are organized into four attack chains. The most severe requires no authentication and abuses an XML external entity (XXE) flaw in a service-import function to steal a trusted local session, reset an account password, and execute commands as the nable service user. The same chain can create a Default Administrator account with credentials chosen by the attacker, giving them full control of the appliance. Two other attack chains start from a predictable appliance passcode that lets an anonymous attacker inject malicious patch metadata. When an administrator opens the patch details, a stored cross-site scripting (XSS) payload runs in their browser and invokes a command-execution interface as the nable user. The administrator’s session can also be hijacked through the same flaw to submit a crafted audit-export configuration that runs commands as root. A fourth chain writes an executable web page into the server’s web directory through a directory traversal flaw in a software repository feature, then escalates to root through a passwordless installer that executes a configuration from a directory the nable user can write to. Bales tested all of the exploits against N-central Appliance 2026.4.0.31, a pre-release build, and noted in the repository’s documentation that most, if not all, of the flaws should work on previous versions, including the most up-to-date release. N-able has not confirmed how many of the 33 flaws it could reproduce, but the new hotfix lists 7 CVEs: CVE-2026-125883 — Multiple XXE vulnerabilities CVE-2026-125878 — Multiple OGNL injection vulnerabilities CVE-2026-125879 — Local privilege escalation to root via nable-writable syslog-ng config CVE-2026-125880 — Stored XSS via MMS3 patch metadata (admin context) CVE-2026-125881 — Schema-hint SSRF via service import schema validation CVE-2026-125882 — RCE via file repository upload path traversal (Credit Nate Fair, Sprocket Security) CVE-2026-91000 — Insecure IPC Channels lead to local privilege escalation Attacks likely to follow N-central has been targeted by attackers in the past and the Able2Shell disclosure is the fourth time in 15 months that N-able has been forced to do an emergency response. In August 2025, the company patched two flaws tracked as CVE-2025-8875 and CVE-2025-8876 that were exploited in the wild as zero-days. In August this year, the company patched an authentication bypass flaw tracked as CVE-2026-18556 that was exploited as a zero-day to deploy ransomware, but the patch was incomplete and attackers quickly found a bypass: CVE-2026-18577. Microsoft attributed the ransomware attacks that abused the flaw to Storm-1175, a financially motivated group linked to China that deployed the StormEncryptor ransomware on MSP-managed systems. In September, security firm Huntress discovered that a fully patched N-central server had been compromised through a new chain of access-control flaws tracked as CVE-2026-86206 and CVE-2026-86207. A day later N-able disclosed CVE-2026-86218, a pre-authentication remote code execution flaw rated 10.0 on the CVSS scale that had also been exploited. N-able claims more than 25,000 MSP partners and telemetry from more than 11 million endpoints. What customers should do With the N-central 2026.4 Hotfix 2 available, N-able said on-premises customers should upgrade as soon as possible, and all customers — hosted and on-premises — must upgrade their Agents and Probes to restore compatibility between the two. Security firm Huntress advised N-central administrators to review authentication activity from Nov. 8 onward, look for administrator accounts, scripts, and remote-access sessions they did not create, and assess every client network managed by the server, not just the server itself. Huntress also cautioned that patched servers may not display a new version number, so administrators should verify fixes against N-able’s guidance rather than the version string. ThreatDefence recommended preserving logs and server snapshots before making any changes, then rotating credentials for administrator and technician accounts, asset-discovery databases, agent registration tokens, and ecosystem agent keys once the server is restored.