cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

N-able Releases N-central Hotfixes for Seven Zero-Day Vulnerabilities

· Original article ↗

Summary

N-able released N-central 2026.4 HF2 to patch seven disclosed vulnerabilities. Hosted servers have been upgraded, and on-premises customers are urged to update. Defused reported probing, but N-able has not said the flaws were exploited.

Key points

  • N-able released N-central 2026.4 HF2 with patches for seven disclosed vulnerabilities, including XXE, OGNL injection, privilege escalation, SSRF, stored XSS, and a path-traversal flaw leading to RCE.
  • N-able said hosted N-central servers across all regions have been upgraded and urged on-premises customers to update, following guidance before restoring normal access.
  • Defused reported probing of N-central systems, including anonymous agent sessions and requests to configuration and remote-control endpoints; N-able has not flagged the flaws as exploited in the wild.
  • Shadowserver reported that exposed N-central servers fell from 1,338 to just over 148.
  • Researcher Sean Bales published proof-of-concept exploits in a repository named Able2Shell and said the flaws affect a pre-release version; he believes earlier versions may also be affected.
  • Bales demonstrated an unauthenticated XXE-to-RCE chain that he said could reset an account password and enable command execution as the nable user.

Article Details

Vulnerability Types
  • XML external entity (XXE) injection
  • OGNL injection
  • Local privilege escalation
  • Stored cross-site scripting (XSS)
  • Server-side request forgery (SSRF)
  • Remote code execution (RCE)
  • Directory traversal
  • Arbitrary file writes
  • Authentication bypass
  • Credential disclosure
  • Insecure IPC channels
Severity
Critical
Affected Versions
  • N-central Appliance 2026.4.0.31 (pre-release; Sean Bales believes most or all earlier versions are also affected)
Exploitation Status
reported
Exploit Availability
public_poc
Patch Status
partial
Workarounds
  • Keep on-premises N-central servers offline until upgraded, and follow N-able's upgrade guidance before restoring normal access.

MITRE ATT&CK

T1059 · Command and Scripting InterpreterThe demonstrated exploit chain can execute commands on the N-central server as the nable user.T1136 · Create AccountThe exploit could create a Default Administrator account with attacker-controlled credentials in the N-central management interface.T1190 · Exploit Public-Facing ApplicationThe disclosed exploit chain targets N-central's service-import functionality with an unauthenticated XXE-to-RCE attack.T1595.002 · Vulnerability ScanningDefused reported observing attackers scanning the Internet for vulnerable N-central systems.

CVE

CVE-2026-125878N-able · N-centralCVE-2026-125878 - Multiple OGNL Injection vulnerabilitiesCVE-2026-125879N-able · N-centralCVE-2026-125879 - Local privilege escalation to root via nable-writable syslog-ng configCVE-2026-125880N-able · N-centralCVE-2026-125880 - Stored XSS via MMS3 patch metadata (admin context)CVE-2026-125881N-able · N-centralCVE-2026-125881 - Schema-hint SSRF via service import schema validationCVE-2026-125882N-able · N-centralCVE-2026-125882 - RCE via file repository upload path traversal (Credit Nate Fair, Sprocket Security)CVE-2026-125883N-able · N-centralCVE-2026-125883 - Multiple XXE VulnerabilitiesCVE-2026-91000N-able · N-centralCVE-2026-91000 - Insecure IPC Channels lead to local privilege escalation

People

Nate FairCredited in the article for the N-central remote code execution vulnerability CVE-2026-125882.Sean BalesSecurity researcher who disclosed the N-central vulnerabilities and published the Able2Shell proof-of-concept exploits.

Vendors

N-ableN-able releases security hotfixes for zero-day vulnerabilities

Products

N-centralN-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted

Tools

Able2ShellSecurity researcher Sean Bales disclosed the vulnerabilities late Sunday, November 8, and published a GitHub repository called Able2Shell containing proof-of-concept exploits for the flaws.

Industries

Enterprise ITN-able provides cloud-based remote monitoring, cybersecurity, and data protection tools for Managed Service Providers (MSPs) and enterprise IT departments at more than 500,000 organizations in over 140 countries.Managed service providersN-central lets IT departments and managed service providers (MSPs) monitor, manage, and maintain client networks and devices from a centralized web-based console.

Related Articles