N-able patches N-central zero-day flaws after taking hosted environments offline
N-able has released hotfixes for multiple zero-day vulnerabilities in its N-central remote monitoring and management platform after publicly disclosed flaws forced the company to take hosted environments offline. N-able said it took hosted N-central environments offline on November 9 and told operators of on-premises servers to keep them offline until further notice.
The fixed release is N-central 2026.4 HF2, according to N-able's update reported by BleepingComputer. The release addresses CVE-2026-125883 for multiple XML external entity vulnerabilities, CVE-2026-125878 for multiple OGNL injection vulnerabilities, CVE-2026-125879 for local privilege escalation to root through an nable-writable syslog-ng configuration, CVE-2026-125880 for stored cross-site scripting in MMS3 patch metadata, CVE-2026-125881 for server-side request forgery through service-import schema validation, CVE-2026-125882 for remote code execution through file-repository upload path traversal and CVE-2026-91000 for local privilege escalation through insecure IPC channels.
Security researcher Sean Bales published proof-of-concept exploits after disclosing the vulnerabilities late on November 8, BleepingComputer wrote. The disclosed issues include remote code execution, authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, XML external entity injection and cross-site scripting. Bales also demonstrated an unauthenticated XML external entity to remote-code-execution chain that abuses N-central's service-import function to steal a trusted local session, reset an account password and execute commands as the nable user.
N-able has not said that the flaws have been exploited in the wild. Defused said it observed attackers scanning the internet for vulnerable N-central systems, including anonymous agent sessions, appliance-configuration requests and unauthenticated access attempts against the remote-control endpoint. That activity shows probing of the disclosed attack surface, but the supplied reports do not confirm a successful compromise.
N-able said all hosted N-central servers had been upgraded and strongly recommended that on-premises customers upgrade to N-central 2026.4 HF2 as soon as possible. The company told operators to follow the published upgrade guidance before restoring normal access. Shadowserver reported that just over 148 N-central servers remained exposed online, down from the 1,338 systems it detected on Monday.