N-able has warned that attackers are actively scanning for vulnerable N-central servers after the publication of proof-of-concept (PoC) code related to critical flaws in its remote monitoring and management (RMM) platform. The company declared a major outage incident on November 9, 2026, and has noted increased scanning activity associated with the released PoC code.
This disclosure was made without the vendor’s involvement. Previously, N-able described the situation as “non-responsible” and temporarily took hosted environments offline as a precaution. The company has advised on-premises customers to keep their servers offline until they complete the necessary upgrades.
Patched Vulnerabilities
N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) and has published seven CVEs. They cover XML external entity (XXE) flaws, OGNL injection bugs, a stored cross-site scripting (XSS) issue, a server-side request forgery (SSRF) issue, and two local privilege escalation paths.
The most serious is CVE-2026-125882, a remote code execution flaw caused by path traversal in the file repository upload function. Nate Fair of Sprocket Security was credited with it. The other six are:
- CVE-2026-125883: multiple XXE vulnerabilities.
- CVE-2026-125878: multiple OGNL injection vulnerabilities. Object-Graph Navigation Language injection has caused remote code execution in other Java products.
- CVE-2026-125879: local privilege escalation to root through a writable syslog-ng configuration.
- CVE-2026-125880: stored XSS through MMS3 patch metadata, in an admin context.
- CVE-2026-125881: SSRF through service import schema validation.
- CVE-2026-91000: local privilege escalation through insecure inter-process communication (IPC) channels.
N-able also said a follow-up hotfix will deliver further security updates.
An RMM server controls many downstream endpoints so that a compromise can give attackers a path into every managed customer. N-central has been attacked before. Attackers exploited CVE-2026-18577 to gain administrative control and abuse the Take Control feature.
CISA later added that flaw to its Known Exploited Vulnerabilities catalog. In those attacks, intruders also registered Cloudflare Tunnel services for persistence.
N-able confirmed on November 11, 2026, at 01:04 UTC that all hosted N-central (NCOD) servers in every region had been upgraded. On-premises administrators must upgrade themselves. Supported direct upgrade paths run from 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1 to 4, and 2026.4 (including Hotfix 1). Earlier versions must first move to a supported build.
Both hosted and on-premises customers must also upgrade Agents and Probes. N-able advises upgrading Agents first and Probes second. A Probe on 2026.4.1.26 or later cannot talk to Agents that are not also upgraded, and features such as the offline patch cache stop working. The built-in remote control is temporarily disabled, though Take Control still works.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
