N-able released N-central 2026.4 HF2 to patch vulnerabilities that researcher Sean Bales disclosed late Sunday, Nov. 8, BleepingComputer reported, after the vendor took hosted N-central environments offline as a precaution¹.

N-central is a remote monitoring and management platform used by IT teams and managed service providers to administer client networks from a web console¹. N-able told BleepingComputer it was responding to what it called non-responsible communication of critical N-central bugs found by an independent researcher¹.

The company said it took hosted N-central offline on Nov. 9 and told on-premises customers to take their servers offline until further notice¹. A Tuesday status update said all hosted N-central servers (NCODs) in all regions had been upgraded, and N-able strongly recommended on-premises customers install the new build as soon as possible, following upgrade guidance before restoring access¹.

Release notes cited in the report list patches for CVE-2026-125883 (multiple XXE), CVE-2026-125878 (multiple OGNL injection), CVE-2026-125879 (local privilege escalation to root via a writable syslog-ng config), CVE-2026-125880 (stored XSS via MMS3 patch metadata), CVE-2026-125881 (schema-hint SSRF), CVE-2026-125882 (remote code execution via file-repository upload path traversal, credited to Nate Fair of Sprocket Security), and CVE-2026-91000 (insecure IPC channels leading to local privilege escalation)¹. N-able said the hotfix covers some of the leaked issues, including the most critical¹.

Bales published a GitHub repository named Able2Shell with proof-of-concept exploits and said the bugs affect N-central Appliance 2026.4.0.31, a pre-release, and likely earlier versions as well¹. The disclosed set, as summarized by BleepingComputer, includes remote code execution, authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, XXE, and XSS¹.

Bales told the outlet he did not notify N-able first because he said the company had not patched other bugs, including two unrelated remote-code-execution issues and a privilege-escalation flaw, that he reported in a different N-able product about five to six months earlier¹. When asked about those allegations, N-able did not address them and instead restated its N-central incident response, BleepingComputer said¹.

N-able has not flagged the newly disclosed flaws as exploited in the wild, the report said¹. Threat-intelligence firm Defused said it had seen probing of N-central for the public zero-days, including anonymous agent sessions, appliance-config pulls, and unauthenticated hits on a remote-control endpoint that it described as part of the exploit surface¹. Shadowserver reported just over 148 N-central servers exposed online, down from 1,338 on Monday, according to BleepingComputer¹.

Independent confirmation of exploitation, and N-able's account of Bales's earlier reports, were not in the article¹.