Throughout this week, N-able has been responding to a number of zero-day vulnerabilities that were not responsibly disclosed. We have prioritized remediation based on the severity and exploitability potential of the vulnerabilities, addressing the highest-risk issues first.
Publication 1: November 9, 2026
The first publication, which was not responsibly disclosed, can be broken down by risk into 3 categories:
- Internet facing and non-authenticated (addressed in N-central 2026.4 HF2)
- Data Leakage that requires Authenticated access
- Data Leakage that requires Privileged Authenticated access (Product Admin)
Given the risk presented by the vulnerabilities that were not responsibly disclosed, we made the choice to take our hosted servers offline and recommend that customers do the same. With the publication of the 2026.4 HF2 these were remediated and we brought our servers online and recommended to customers they do the same.
The Data Leakage vulnerabilities that remain require Authenticated or Privileged Authenticated access and have lower exploitability because prior authenticated access (including 2FA) is required. The vulnerabilities that require Authenticated access would allow an account to gain additional permissions and roles beyond their intended scope. Privileged Authenticated access would enable someone with Product Admin credentials to access parts of the application that are normally not available. While this is important to address, if an attacker already has Product Admin access, the risk to the organization is greater through their access to use the product for malicious actions than accessing system settings.
Publication 2: November 12, 2026
In the second publication this week, which was also not responsibly disclosed, additional zero-day vulnerabilities were released. These can be grouped into two categories:
- Legacy API abuse
- Agent Impersonation
The Legacy API is defaulted to off and not a recommended configuration. It was maintained only for customers who explicitly needed it for legacy operations. Without customers explicitly turning this feature on, and accepting risk in doing so, customers are protected.
With regards to Agent Impersonation, to take advantage of the vulnerability an attacker would already need to have a foothold on an endpoint. The attacker could then use the vulnerability to simulate being an agent, which would allow the attacker to receive information about agent tasks and scripts and to set its status and metrics in N-central. The attacker would only be able to receive the same information an agent does through normal operation and set the same values that an agent can set.
Hotfix Details
N-central 2026.4 HF2
HF2 includes a number of security patches and technology updates that improve the overall security of N-central, and addresses all the internet facing and non-authenticated vulnerabilities. With HF2 in place, we were able to bring our hosted N-central servers online and recommended that customers return to operational status. While we are working to address the Authenticated and Privileged Authenticated Data Leakage, this risk is lower as Authenticated Access requires 2FA, reducing the risk.
HF2 also addressed a number of CVEs:
- CVE-2026-125883 – Multiple XXE Vulnerabilities
- CVE-2026-125878 – Multiple OGNL Injection vulnerabilities
- CVE-2026-125879 – Local privilege escalation to root via N-able-writable syslog-ng config
- CVE-2026-125880 – Stored XSS via MMS3 patch metadata (admin context)
- CVE-2026-125881 – Schema-hint SSRF via service import schema validation
- CVE-2026-125882 – RCE via file repository upload path traversal (Credit Nate Fair, Sprocket Security)
- CVE-2026-91000 – Insecure IPC Channels lead to local privilege escalation
N-central 2026.4 HF3
We are currently developing a forthcoming hotfix (HF3) that further reduces risk from the first publication. It strengthens authentication and permission checks (resolving the Authenticated access vulnerabilities from the first publication). It will also harden how Agents, Probes and appliances authenticate and communicate, limiting an attacker’s ability to perform Agent Impersonation, further remediating the risk. HF3 will also permanently remove access to the Legacy API.
We will continue to publish further updates in risk order as we move forward.