cyber.hendryadrian.com
Vulnerability & Exploit · rapid7.com

N-able Releases N-central Hotfix for Critical Vulnerabilities After PoC Scanning

· Original article ↗

Summary

Rapid7 reports that N-able's N-central faced 33 publicly disclosed issues, including unauthenticated RCE. N-able reported scanning tied to the public PoC but no evidence of successful customer exploitation. Hotfix 2 fixes seven CVEs; hosted systems were upgraded.

Key points

  • The Able2Shell disclosure covers 33 issues, including unauthenticated RCE, privilege escalation, credential disclosure, and unauthorized account creation.
  • A reported unauthenticated exploit chain combines XXE and session-handling weaknesses to execute code as the nable service account; other demonstrated chains involve malicious patch metadata or ProductAdmin credentials.
  • N-able reported scanning activity associated with the published PoC code, but said it had no evidence of successful exploitation of customer environments at that time.
  • N-central 2026.4 Hotfix 2 (build 2026.4.1.26), released November 10, addresses seven CVEs; N-able plans a follow-up hotfix with further security updates.
  • N-able confirmed that hosted N-central servers across all regions were upgraded by November 11. Rapid7 advises on-premises operators to upgrade urgently and keep servers offline until upgraded.
  • Customers should upgrade Agents before Probes, following vendor compatibility guidance, and review N-central servers and downstream managed systems for signs of compromise.

Article Details

Vulnerability Types
  • XML external entity (XXE)
  • OGNL injection
  • Local privilege escalation
  • Stored cross-site scripting (XSS)
  • Server-side request forgery (SSRF)
  • Remote code execution (RCE)
  • Path traversal
  • Insecure inter-process communication (IPC)
Severity
Critical
Affected Versions
  • N-central Appliance 2026.4.0.31 (researcher-tested; full affected-version range not specified)
Exploitation Status
reported
Exploit Availability
public_poc
Patch Status
available
Workarounds
  • Keep on-premises N-central servers offline until successfully upgraded.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe disclosed vulnerabilities include local privilege escalation to root, including through a nable-writable syslog-ng configuration and insecure IPC channels.

CVE

CVE-2026-125878N-able · N-centralCustomers leveraging Rapid7’s Intelligence Hub can access Suricata detection rules for CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, and CVE-2026-125882.CVE-2026-125879N-able · N-centralCustomers leveraging Rapid7’s Intelligence Hub can access Suricata detection rules for CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, and CVE-2026-125882.CVE-2026-125880N-able · N-centralCustomers leveraging Rapid7’s Intelligence Hub can access Suricata detection rules for CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, and CVE-2026-125882.CVE-2026-125881N-able · N-centralCustomers leveraging Rapid7’s Intelligence Hub can access Suricata detection rules for CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, and CVE-2026-125882.CVE-2026-125882N-able · N-centralCustomers leveraging Rapid7’s Intelligence Hub can access Suricata detection rules for CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, and CVE-2026-125882.CVE-2026-125883N-able · N-centralCustomers leveraging Rapid7’s Intelligence Hub can access Suricata detection rules for CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, and CVE-2026-125882.

People

Nate FairCredited for CVE-2026-125882, concerning remote code execution through file-repository upload path traversal.

Vendors

N-ableOn November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform.

Products

N-centralOn November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform.Patch Management Engineupgrade Agents first, then Probes, following the vendor's compatibility guidance for the Patch Management Engine (PME).

Industries

Enterprise ITN-central is used by managed service providers (MSPs) and enterprise IT teams to administer endpoints and infrastructure. Compromise of an RMM server can put downstream managed environments at risk. N-central hasManaged service providersN-central is used by managed service providers (MSPs) and enterprise IT teams to administer endpoints and infrastructure. Compromise of an RMM server can put downstream managed environments at risk. N-central has

Related Articles