N-central: N-able ships a critical update after exploits for its RMM platform go public

Top-Secured cyber watch: independent analysis based on the sources listed below. Top-Secured is not affiliated with the companies mentioned and will never ask you for your bank details or passwords.

N-able has released N-central 2026.4 HF2, a critical update fixing seven CVEs, after a researcher published exploit code for its remote management platform. The vendor has seen scanning activity and asks on-premises customers to keep their servers off the internet until they run build 2026.4.1.26.

What happened

On 9 November 2026, a researcher published details and proof-of-concept exploits for a series of vulnerabilities in N-central, the N-able remote monitoring and management (RMM) platform that many IT service providers use to run their customers’ workstations and servers. According to The Hacker News, more than 30 flaws are involved, grouped under the name Able2Shell, and N-able briefly took its hosted N-central environment offline while urging on-premises customers to shut down their servers. N-able says the flaws did not reach it through its usual reporting channels.

On 10 November, N-able released N-central 2026.4 HF2 (build 2026.4.1.26), described as a critical security update. It fixes seven CVEs, including OGNL injections (CVE-2026-125878, CVSS v4 8.7), code execution through path traversal in the file repository upload (CVE-2026-125882, 8.6), XXE, SSRF, stored XSS and two local privilege escalations, one of them to root. In a post on 11 November, N-able states that every flaw exploitable without authentication is now fixed; the remaining ones require an account, often a privileged one, and will be handled in later hotfixes.

Who is at risk

Every N-central server older than 2026.4.1.26, first of all on-premises servers reachable from the internet. N-able reports scanning activity linked to the published exploit code and no sign of compromise on its hosted servers, which have been upgraded and are back online; it does not vouch for on-premises installations. On 12 November, according to The Hacker News, N-able said it was looking into a new disclosure targeting HF2 which, in its first analysis, requires the Legacy API to be enabled and exposed to the internet, a non-default setting.

What to do now

1. Cut internet access to the N-central server until it is upgraded, as N-able recommends.
2. Upgrade to 2026.4.1.26; servers older than 2025.4 must first move to a supported version.
3. Upgrade the Agents, then the Probes, on hosted and on-premises deployments alike.
4. Make sure the Legacy API is disabled, or at least unreachable from the internet.
5. Review accounts and logs since 9 November: unknown administrators, unexpected uploads to the file repository, scripts pushed to endpoints.
6. If a provider manages your machines with N-central, ask them in writing which build they run and whether the console is exposed.

Note that HF2 temporarily disables built-in remote control; Take Control still works.

Our take

An RMM console can push code to every machine it manages: taking it over means reaching every company behind it at once. It belongs behind a VPN or an IP allow-list, never openly on the internet, and its updates deserve the same urgency as those of a firewall.

Sources

• N-able — Update on N-central 2026.4 HF2 and ongoing security response
• N-able Status — N-central 2026.4 HF2 Release Notes
• CVE Program — CVE-2026-125878, Multiple OGNL Injection vulnerabilities
• The Hacker News — N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
• The Hacker News — New N-central Exploits Work Against Patched Servers

How we choose, verify and write our analyses →