N-able has released N-central 2026.4 Hotfix 2 after the public disclosure of 33 alleged vulnerabilities forced a worldwide shutdown of its hosted remote monitoring and management platform.
Released on November 10, the emergency update, build 2026.4.1.26, fixes seven published CVEs and adds security changes across the server, Agents, and Probes.
The shutdown began on November 9, affecting hosted services across the Americas, Europe, and Asia-Pacific. N-able also advised customers running their own servers to take them offline.
Cybersecuritynews.com previously covered the N-central shutdown and Able2Shell disclosure, which included public proof-of-concept code for attacks against the platform.
N-able N-central vulnerabilities
The research, published by Sean Bales through the Oracle-Security GitHub account, describes four exploit chains. Huntress reported that three could lead to remote code execution, while another could raise an attacker’s access to root. The research targeted N-central Appliance 2026.4.0.31, with earlier versions also potentially affected.
One reported chain combines an XML external entity flaw with trusted session abuse to reset an account password and run commands as the N-able service account.
Other paths involve malicious patch data, file upload weaknesses, and local privilege escalation. These paths matter because N-central manages customer devices, making server access valuable to attackers.
N-able has observed scanning linked to the published exploit code, according to its incident update. Scanning alone does not establish a successful breach.
Huntress’s updated report says hosted servers were upgraded and brought back online on November 10. Customers should not treat restored cloud access as proof that their own deployments are fully updated.
N-able’s official release notes list fixes for XXE, OGNL injection, stored cross-site scripting, server-side request forgery, file repository path traversal leading to code execution, and two privilege escalation issues.
The seven CVEs do not establish that all 33 researcher claims were individually confirmed or fully resolved. N-able has announced further security updates.
The hotfix strengthens authentication, permission checks, file validation, server components, and web protections. It also removes legacy mobile device management and updates operating system and third-party components. Built-in remote control remains temporarily disabled, although Take Control continues working.
Both hosted and on-premises customers must update Agents and Probes. N-able directs customers to upgrade Agents first, then Probes, because incompatible versions can interrupt communication and disable features such as offline patch caching. Older server releases require a supported intermediate upgrade.
This follows a separate N-central authentication bypass incident reported in August. Administrators should follow the new release guidance rather than assume earlier hotfixes cover Able2Shell. Keep unpatched servers offline until their upgrade succeeds.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
