N-able N-central gets emergency fix two days after 33 exploits published
CSO Online ·
N-able has taken its hosted N-central remote monitoring and management (RMM) platform offline worldwide and shipped an emergency hotfix after a security researcher released 33 zero-day exploits for the software, including attack chains that could let unauthenticated attackers take over servers. N-central is used by managed service providers (MSPs) and enterprise IT teams to remotely manage, patch, and support endpoint systems, so a compromised server can expose every computer under its control. N-able said it took the hosted environments offline as a precaution and advised customers using the on-premises version to shut down their servers until it released the fix, N-central 2026.4 HF2 , on Tuesday. The vulnerabilities were disclosed late Sunday by an offensive security researcher named Sean Bales who uses the GitHub handle Oracle-Security. The release includes proof-of-concept exploit chains that require no authentication and could result in command execution as the service account and, in some cases, root access. N-able said it has already observed scanning activity associated with the published exploits but has not seen evidence that any customer environment has been successfully exploited. Censys found 1,728 internet-exposed N-central instances , and security firm Previdian recorded 68 exploitation attempts against one of its honeypots from a single IP address within about 18 hours of the publication. Exploit chains lead to remote code execution The 33 exploits , which the researcher dubbed Able2Shell, are organized into four attack chains. The most severe requires no authentication and abuses an XML external entity (XXE) flaw in a service-import function to steal a trusted local session, reset an account password, and execute commands as the nable service user. The same chain can create a Default Administrator account with credentials chosen by the attacker, giving them full control of the appliance. Two other attack chains start from a predictable appliance passcode that lets an anonymous attacker inject malicious patch metadata. When an administrator opens the patch details, a stored cross-site scripting (XSS) payload runs in their browser and invokes a command-execution interface as the nable user. The administrator’s session can also be hijacked through the same flaw to submit a crafted audit-export configuration that runs commands as root. A fourth chain writes an executable web page into the server’s web directory through a directory traversal flaw in a software repository feature, then escalates to root through a passwordless installer that executes a configuration from a directory the nable user can write to. Bales tested all of the exploits against N-central Appliance 2026.4.0.31, a pre-release build, and noted in the repository’s documentation that most, if not all, of the flaws should work on previous versions, including the most up-to-date release. N-able has not confirmed how many of the 33 flaws it could reproduce, but the new hotfix lists 7 CVEs: CVE-2026-125883 — Multiple XXE vulnerabilities CVE-2026-125878 — Multiple OGNL injection vulnerabilities CVE-2026-125879 — Local privilege escalation to root via nable-writable syslog-ng config CVE-2026-125880 — Stored XSS via MMS3 patch metadata (admin context) CVE-2026-125881 — Schema-hint SSRF via service import schema validation CVE-2026-125882 — RCE via file repository upload path traversal (Credit Nate Fair, Sprocket Security) CVE-2026-91000 — Insecure IPC Channels lead to local privilege escalation Attacks likely to follow N-central has been targeted by attackers in the past and the Able2Shell disclosure is the fourth time in 15 months that N-able has been forced to do an emergency response. In August 2025, the company patched two flaws tracked as CVE-2025-8875 and CVE-2025-8876 that were exploited in the wild as zero-days. In August this year, the company patched an authentication bypass flaw tracked as CVE-2026-18556 that was exploited as a zero-day to deploy ransomware, but the patch was incomplete and attackers quickly found a bypass: CVE-2026-18577. Microsoft attributed the ransomware attacks that abused the flaw to Storm-1175, a financially motivated group linked to China that deployed the StormEncryptor ransomware on MSP-managed systems. In September, security firm Huntress discovered that a fully patched N-central server had been compromised through a new chain of access-control flaws tracked as CVE-2026-86206 and CVE-2026-86207. A day later N-able disclosed CVE-2026-86218, a pre-authentication remote code execution flaw rated 10.0 on the CVSS scale that had also been exploited. N-able claims more than 25,000 MSP partners and telemetry from more than 11 million endpoints. What customers should do With the N-central 2026.4 Hotfix 2 available, N-able said on-premises customers should upgrade as soon as possible, and all customers — hosted and on-premises — must upgrade their Agents and Probes to restore compatibility between the two. Security firm Huntress advised N-central administrators to review authentication activity from Nov. 8 onward, look for administrator accounts, scripts, and remote-access sessions they did not create, and assess every client network managed by the server, not just the server itself. Huntress also cautioned that patched servers may not display a new version number, so administrators should verify fixes against N-able’s guidance rather than the version string. ThreatDefence recommended preserving logs and server snapshots before making any changes, then rotating credentials for administrator and technician accounts, asset-discovery databases, agent registration tokens, and ecosystem agent keys once the server is restored.