N-able has released an emergency security update for its N-central remote-management platform after researcher Sean Bales published 33 alleged zero-day vulnerabilities and accompanying proof-of-concept code. The company’s N-central 2026.4 Hotfix 2, released Nov. 10 as build 2026.4.1.26, addresses seven newly assigned CVEs and temporarily disables the product’s built-in remote-control feature.
The fixed issues span several attack classes, including XML external entity processing, OGNL injection, stored cross-site scripting, server-side request forgery, file-upload path traversal leading to remote code execution, and two local privilege-escalation flaws. N-able lists CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 and CVE-2026-91000 in its release notice.
Severity is high across the set. According to Tenable’s analysis of N-able’s records, the seven vulnerabilities carry CVSS v4 scores from 8.3 to 9.3: the XXE and schema-hint SSRF flaws score 9.3, OGNL injection 8.7, the syslog-ng and file-repository issues 8.6, insecure IPC 8.4, and the stored XSS issue 8.3. The published CVE records describe the affected software as N-central versions before 26.4.1.
The disclosure, described as “Able2Shell,” does not establish that all 33 claims have been independently confirmed by N-able or mapped to separate CVE records. The company’s hotfix formally identifies seven vulnerabilities, and N-able has not publicly said that every issue in the researcher’s release is exploitable or resolved. There is also no verified public report in the available advisories attributing the flaws to a named threat actor or confirming exploitation in the wild.
N-able says on-premises customers should upgrade their servers as soon as possible, while hosted N-central customers will have their servers upgraded by the provider. In both deployment models, customers must separately update N-central Agents and Probes. The hotfix changes Agent-to-Probe communication, and incompatible versions can interrupt features such as the offline patch cache. N-able also warns that built-in remote control is unavailable until a future fix, although its separate Take Control feature continues to operate.
Administrators should verify the server build, apply 2026.4.1.26 where supported, and complete the Agent and Probe upgrades rather than treating a hosted-server update as sufficient. Organizations running older releases must first move to a supported upgrade path. Because public PoCs are available and N-central commonly sits inside managed-service-provider environments, defenders should also review authentication, administrative activity, file uploads and unexpected privilege changes while checking vendor guidance for further indicators.
