N-central 2026.4 HF2: critical fix after public exploits

Call: Patch now. N-able released N-central 2026.4 HF2 (build 2026.4.1.26) on Nov 10 and calls it “a critical security update.” It fixes seven CVEs. N-able says on-prem customers “should upgrade their servers as soon as possible,” and “all customers, both hosted and on-premises, must upgrade their Agents and Probes.” Working exploit code is public, and this is an RMM server that reaches every machine it manages. Don’t wait for a maintenance window.

What happened: Huntress (opens in a new tab) and CSO Online (opens in a new tab) report that on Nov 8 a researcher published 33 N-central vulnerabilities with proof-of-concept exploits, which he calls “Able2Shell.” BleepingComputer (opens in a new tab) names him as Sean Bales and says he gave N-able no notice first. Bales says N-able ignored his earlier reports. CSO Online describes four attack chains. The worst needs no login: an XXE in service import steals a trusted local session, resets a password, and creates a Default Administrator account the attacker controls.

Huntress and CSO Online also report that N-able took hosted N-central offline on Nov 9 and told on-prem customers to shut their servers down. Huntress says N-able’s status page reported “scanning activity associated with the published proof-of-concept code” but no successful compromise of any customer. Huntress hasn’t seen exploitation in its partners’ environments. N-able’s release notes mention none of this: not Able2Shell, not the outage, not scanning.

What HF2 fixes (N-able’s list):

CVE-2026-125883: multiple XXE vulnerabilities
CVE-2026-125878: multiple OGNL injection vulnerabilities
CVE-2026-125879: local privilege escalation to root via a syslog-ng config the nable user can write
CVE-2026-125880: stored XSS via MMS3 patch metadata (admin context)
CVE-2026-125881: schema-hint SSRF via service import schema validation
CVE-2026-125882: RCE via file repository upload path traversal
CVE-2026-91000: insecure IPC channels, local privilege escalation

N-able also says HF2 removes legacy mobile device management and hardens authentication, file and log handling, and Agent-Probe communication. It doesn’t map the seven CVEs to the 33 published bugs.

Who’s hit: MSPs and IT teams on N-central, on-prem or hosted. HF2 supersedes 2026.4 (build 2026.4.0.27) and 2026.4 HF1 (build 2026.4.0.32).

Fix:

On-prem: upgrade the server to build 2026.4.1.26. N-able supports upgrading from 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 (HF1 to HF4), 2026.4 and 2026.4 HF1. Anything older has to step up to one of those first.
Hosted (NCOD): N-able upgrades the server for you.
Everyone: upgrade Agents first, then Probes. HF2 changes how they talk. An upgraded Probe can’t talk to older Agents, which breaks features such as the offline patch cache until the Agents catch up. N-able pushes the patch engine (PME) update automatically.

Known issue: N-able says “built-in remote control is temporarily disabled” in HF2 and will come back in a later fix. “Take Control continues to work as expected.” Plan on Take Control for remote sessions.

Workaround: N-able’s release notes give none. Huntress and CSO Online report N-able told on-prem customers to keep servers offline until they’re patched. If you can’t upgrade today, keep the server off the internet.

After you patch: Huntress advises reviewing sign-ins from Nov 8 on and looking for admin accounts, scripts and remote sessions you didn’t create, across the client networks as well as the server. CSO Online relays advice from ThreatDefence to rotate admin and technician credentials and agent registration tokens.

Huntress counts this as N-central’s fourth round of serious bugs this year, after CVE-2026-18556 in August and the exploited CVE-2026-86218 in September.

Sources: N-able: N-central 2026.4 HF2 release notes (opens in a new tab), Huntress (opens in a new tab), CSO Online (opens in a new tab), BleepingComputer (opens in a new tab).

N-central 2026.4 HF2: critical fix after public exploits

Sources

More from November 2026 patch cycle