N-able Patches N-central Flaws as Attackers Probe Exposed Instances
Summary
N-able released patches for several N-central flaws disclosed with proof-of-concept code. The company says unauthenticated vulnerabilities are fixed, scanning is underway, and it has seen no indications of compromise on hosted servers.
Key points
- Researcher Sean Bales published details and proof-of-concept code for more than 30 N-central vulnerabilities, which he called Able2Shell.
- N-able took hosted N-central environments offline during its investigation, then restored them after developing fixes for higher-priority flaws.
- N-able says it fixed the vulnerabilities exploitable without authentication; other flaws requiring an account or additional conditions are scheduled for later hotfixes.
- N-central 2026.4 HF2 includes patches for the resolved vulnerabilities. N-able urged customers to update on-premises deployments promptly.
- N-able reported scanning associated with the public proof-of-concept code but said it had seen no indications of compromise on hosted servers.
- Defused reported anonymous agent sessions, appliance-configuration access, and attempts to reach an unauthenticated remote-control endpoint.
Article Details
- Vulnerability Types
- XML external entity (XXE)
- Cross-site scripting (XSS)
- Privilege escalation
- Server-side request forgery (SSRF)
- Missing authentication
- Path traversal leading to remote code execution
- Severity
- CVSS scores up to 9.3
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Disconnect on-premises N-central deployments from the network until they can be updated.
MITRE ATT&CK
CVE
CVE-2026-125878N-able · N-centralThe resolved vulnerabilities include CVE-2026-125883 (multiple XXE issues, CVSS score of 9.3), CVE-2026-125878 (XSS flaws, CVSS score of 8.7), CVE-2026-125879 (privilege escalation, CVSS score of 8.6), CVE-2026-125880CVE-2026-125879N-able · N-central(multiple XXE issues, CVSS score of 9.3), CVE-2026-125878 (XSS flaws, CVSS score of 8.7), CVE-2026-125879 (privilege escalation, CVSS score of 8.6), CVE-2026-125880 (XSS, CVSS score of 8.3), CVE-2026-125881CVE-2026-125880N-able · N-central(XSS flaws, CVSS score of 8.7), CVE-2026-125879 (privilege escalation, CVSS score of 8.6), CVE-2026-125880 (XSS, CVSS score of 8.3), CVE-2026-125881 (SSRF, CVSS score of 9.3), and CVE-2026-91000 (missingCVE-2026-125881N-able · N-centralCVE-2026-125879 (privilege escalation, CVSS score of 8.6), CVE-2026-125880 (XSS, CVSS score of 8.3), CVE-2026-125881 (SSRF, CVSS score of 9.3), and CVE-2026-91000 (missing authentication, leading to privilegeCVE-2026-125882N-able · N-centralAdditionally, the update resolves CVE-2026-125882 (path traversal to remote code execution, CVSS score of 8.6), which was reported by Nate Fair of Sprocket Security.CVE-2026-125883N-able · N-centralThe resolved vulnerabilities include CVE-2026-125883 (multiple XXE issues, CVSS score of 9.3), CVE-2026-125878 (XSS flaws, CVSS score of 8.7), CVE-2026-125879 (privilege escalation, CVSS score of 8.6), CVE-2026-125880CVE-2026-91000N-able · N-centralof 8.6), CVE-2026-125880 (XSS, CVSS score of 8.3), CVE-2026-125881 (SSRF, CVSS score of 9.3), and CVE-2026-91000 (missing authentication, leading to privilege escalation, CVSS score of 8.4).
People
John PagliucaN-able president and CEO who commented on the publication of exploit code before customers could act.Nate FairReported CVE-2026-125882, a path-traversal vulnerability leading to remote code execution.Sean BalesSecurity researcher who published details and proof-of-concept code for more than 30 N-central vulnerabilities he calls Able2Shell.