Is your N-able N-central RMM still exposed after the November 2026 disclosure?
N-able has released N-central 2026.4 Hotfix 2, build 2026.4.1.26, and published seven CVEs after a public disclosure of critical vulnerabilities. It is observing scanning activity associated with published proof-of-concept code and still recommends that servers stay offline until they are successfully upgraded. Hosted regions are being upgraded. A follow-up hotfix will add further security updates.
Upgrade to 2026.4 HF2. Stay offline until upgraded. Not in CISA KEV
N-able's current Uptime wording (checked at 22:27 GMT on 10 November 2026) is that it is observing scanning activity associated with published proof-of-concept code, and that servers should remain offline until they have been successfully upgraded. We do not link that code. N-central 2026.4 HF2, build 2026.4.1.26, is available. A follow-up hotfix will provide further security updates. None of the seven published CVEs was in CISA's Known Exploited Vulnerabilities catalogue when we checked at 22:27 GMT (catalogue 2026.11.10, released at 19:03 UTC). Prefer the HF2 release notes and uptime.n-able.com.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 10 November 2026, 22:41 GMT.
At a Glance
Based on N-able Uptime and the official 2026.4 HF2 release notes, checked at 22:27 GMT on 10 November 2026. Last updated 10 November 2026, 22:41 GMT.
Critical (vendor wording)
N-able calls them critical vulnerabilities and has published seven CVEs. We have not assigned our own scores.
Scanning observed
N-able is observing scanning activity associated with published proof-of-concept code. It has not, in that update, confirmed successful compromise.
Hosted and on-prem RMM
Stay offline until each server is successfully upgraded to 2026.4.1.26. Hosted regions are being upgraded.
2026.4 HF2, build 2026.4.1.26
Available now. A follow-up hotfix will add further updates. Not in CISA KEV (checked 10 Nov, catalogue 2026.11.10).
N-able opens a Major Outage incident after a public disclosure of critical vulnerabilities by an independent security researcher, takes hosted N-central offline, and advises on-prem customers to take servers offline.
N-able publishes N-central 2026.4 HF2 release notes (build 2026.4.1.26) and the seven related CVEs.
Uptime title is 'Release Available'. N-able is observing scanning activity associated with published proof-of-concept code, is upgrading hosted regions, and still recommends remaining offline until each server is successfully upgraded. A follow-up hotfix is planned.
Upgrade to 2026.4.1.26, keep the server offline until that upgrade has succeeded, upgrade Agents and Probes, and hunt from 8 November.
Affected scope
| Scope | Status | Action |
|---|---|---|
| N-able N-central RMM (on-premises) | Upgrade to 2026.4.1.26 | N-able strongly recommends upgrading as soon as possible. Keep the server offline until it has been successfully upgraded. Follow the supported upgrade path in the HF2 notes. |
| N-able N-central RMM (hosted / NCOD) | N-able is upgrading hosted regions | Access is restored as each region, including trials, completes upgrade and validation. Hosted customers must still upgrade Agents and Probes (Agents first, then Probes). |
| N-central 2026.4 and HF1 | Superseded by HF2 | 2026.4 is build 2026.4.0.27; HF1 is 2026.4.0.32. Upgrade to HF2 (2026.4.1.26). |
| Supported earlier releases | Upgrade via a supported path | HF2 supports upgrades from 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 HF1 to HF4, 2026.4 and HF1. Earlier releases must go to a supported version first. |
CVEs published with 2026.4 HF2
Titles follow N-able's official Uptime and HF2 wording. Credited to security researchers; we do not name them. None of these seven was in CISA KEV catalogue 2026.11.10 when we checked at 22:27 GMT on 10 November 2026.
| CVE | N-able title |
|---|---|
| CVE-2026-125883 | Multiple XXE vulnerabilities |
| CVE-2026-125878 | Multiple OGNL injection vulnerabilities |
| CVE-2026-125879 | Local privilege escalation to root via nable-writable syslog-ng config |
| CVE-2026-125880 | Stored XSS via MMS3 patch metadata (admin context) |
| CVE-2026-125881 | Schema-hint SSRF via service import schema validation |
| CVE-2026-125882 | RCE via file repository upload path traversal |
| CVE-2026-91000 | Insecure IPC channels leading to local privilege escalation |
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Tick both tracks. Vendor steps and our advice are labelled.
Upgrade and stay offline until done
- N-able: upgrade on-prem servers to 2026.4.1.26 as soon as possible; keep each server offline until the upgrade has succeeded; upgrade Agents first, then Probes.
- N-able: hosted customers should wait for the region upgrade to complete and must still upgrade Agents and Probes.
- Our advice: if a server cannot be upgraded at once, remove all internet exposure now and keep it offline.
- Our advice: find every N-central instance across client estates and plan fallback client access while the RMM is down.
Hunt and contain
- Our advice: review N-central logins and audit logs from 8 November onwards, including the period before servers went offline or were upgraded.
- Our advice: look for new or re-enabled administrator accounts, unexpected credential changes, unusual service-import or XML activity, and unexpected file-repository uploads.
- Our advice: look for unexpected processes as
nableor root, and for agent-launched scripts or tools on managed endpoints that are new versus your baseline. - Our advice: if you find signs of compromise, isolate the server, keep logs, rotate N-central and client credentials, and start incident response for every managed client.
Proactive: Vendor Steps, Then Ours
N-able's advice first. CybaVerse advice is labelled separately and is not a substitute for N-able's guidance.
Upgrade on-prem servers to 2026.4.1.26
N-able strongly recommends that on-premises customers upgrade to N-central 2026.4 HF2, build 2026.4.1.26, as soon as possible, and keep each server offline until the upgrade has succeeded. Download the release from Software Downloads SD-000143 and follow the HF2 release notes, including the supported upgrade path. Prefer the Uptime incident for the latest wording.
Upgrade Agents, then Probes
Hosted and on-premises customers must still upgrade Agents and Probes. N-able's notes say to upgrade Agents first, then Probes, and to follow the compatibility rules in the notes. See N-able's Agent and Probe upgrade guidance.
Hosted regions and the follow-up hotfix
N-able is upgrading all hosted (NCOD) regions, including trials. Access is restored as each region completes upgrade and validation. Uptime also says a follow-up hotfix will be released to provide further security updates. Watch Uptime and the HF2 notes. After HF2, built-in remote control is temporarily disabled; Take Control still works.
Inventory and remove leftover exposure
Find every N-central instance across your estate and your clients', hosted and on-prem, including lab appliances. If a server cannot be upgraded at once, remove all internet exposure at the firewall or edge and keep it offline until it is upgraded.
Plan fallback client access
Plan how you will reach clients while classic N-central is down or mid-upgrade: a separate remote access path, out-of-band admin accounts that do not depend on N-central, and an agreed client contact route.
Confirm the installed build
After upgrade, confirm the installed build is 2026.4.1.26 against N-able's release notes, not the marketing version string alone. Add 2026.4.1.26 to FIXED_BUILDS in both checkers if you want the reserved FIXED BUILD verdict, and still upgrade Agents and Probes and watch for the follow-up hotfix.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.
check-ncentral.sh
Read-only offline checker. Reads an inventory CSV (or a single host), optional access logs and an audit export, then reports exposure. It never contacts N-central. The shipped FIXED_BUILDS list is still empty, so it never returns the reserved FIXED BUILD verdict. N-able has named server build 2026.4.1.26; a follow-up hotfix is also planned, and Agents and Probes still need upgrading. Add 2026.4.1.26 yourself if you want that verdict for the server build.
bash check-ncentral.sh --csv inventory.csv
# Single host
bash check-ncentral.sh --host nc01 --exposed yes --version 2026.4.0.31
# Optional access log and audit export review
bash check-ncentral.sh --csv inventory.csv --log access.log --audit audit-export.csvCheck-NCentral.ps1
The same checks in PowerShell 7, with identical output and exit codes. It also runs under PowerShell on Linux.
pwsh -File Check-NCentral.ps1 -Csv inventory.csv
pwsh -File Check-NCentral.ps1 -HostName nc01 -Exposed yes -Version 2026.4.0.31KQL and Sigma
15 KQL hunts for Microsoft Sentinel and Defender (Q1 to Q1d inventory and exposure; Q2 and Q2b web paths; Q3 audit; Q4 and Q4b server processes; Q5 web file writes; Q6 to Q6e managed-endpoint hunts for agent-launched scripts and tools since 8 November versus a 30-day baseline). 6 Sigma rules cover the same ground for other SIEM platforms, with Kusto conversions included. None of the KQL has been run against a live tenant yet.
Verdicts
- OFFLINE/NOT EXPOSEDRecorded as offline, or as not internet exposed (you should still upgrade to 2026.4.1.26).
- EXPOSED / NO PATCH AVAILABLERecorded as internet exposed. No build is reported as patched while the shipped fixed-build list is empty.
- UNKNOWNExposure value missing or not recognised; also log or audit review alone with no hits.
- FIXED BUILDReserved. Never returned until you add a named build such as 2026.4.1.26 to both checkers.
- LOG REVIEWOur log or audit patterns matched (overrides the inventory verdict).
Exit codes
| Code | Meaning |
|---|---|
| 0 | OFFLINE/NOT EXPOSED |
| 1 | EXPOSED / NO PATCH AVAILABLE |
| 2 | UNKNOWN |
| 3 | FIXED BUILD (reserved; never while list empty) |
| 4 | LOG REVIEW |
| 5 | Usage or read error |
CSV mode exits with the worst row (1 > 2 > 0). Exit 4 overrides when a log or audit pattern hits. The full pack zip contains 31 files.
Know the limits
- Both checkers are read-only and offline. They only read the files you point them at, send no network traffic, write nothing and contain no exploit payloads.
- N-able has published no indicators of compromise. Every hunting pattern is our own and is marked unverified where it rests on assumed log fields.
- None of the KQL has been run against a live tenant. Fields and paths marked UNVERIFIED depend on your connectors.
- Agent activity after hosted N-central went offline, or during the hosted upgrade, may be legitimate Ecoverse or Take Control work, or leftover on-prem activity. The managed-endpoint hunts flag new activity versus baseline; they do not prove compromise on their own.
- Prefer the hand-written KQL. Some Sigma pipeline conversions map web rules poorly, as the pack README explains.
What is in the pack
| File | What it does |
|---|---|
| check-ncentral.sh | Offline exposure checker for Linux and macOS (bash) |
| Check-NCentral.ps1 | The same checker in PowerShell 7 |
| KQL (15 hunts) | Microsoft Sentinel and Defender hunts Q1 to Q6e |
| Sigma (6 rules) | Windows, Linux and web rules, plus Kusto conversions |
| tests/ | Fixtures, bash and Pester tests and a sandboxed no-network run |
| README.md | Verified facts, N-able vs our advice, limits and usage |
Reactive: How to Hunt (Our Advice)
N-able has published no indicators of compromise. The hunts below are CybaVerse advice, aligned with the official CVE themes. CybaOps can run them across your estate or your clients'.
Logins and admin changes from 8 November
Review N-central login and audit logs from 8 November onwards, including activity before servers went offline or were upgraded. Look for new or re-enabled administrator accounts and unexpected credential changes.
Service import, XML and file repository activity
Look for unusual service-import or XML handling (the official CVEs include XXE and schema-hint SSRF via service import) and for unexpected file-repository uploads (an official CVE describes path-traversal remote code execution on that path). Correlate with new sessions and privilege changes.
Processes as nable or root
On the N-central host, look for unexpected processes running as nable or root, and for changes that would match the official local privilege-escalation CVEs (including syslog-ng configuration and insecure IPC).
Managed endpoints (agent activity since 8 November)
Check managed endpoints for scripts, tools or remote sessions launched by the N-central agent that are new versus a pre-8-November baseline (pack hunts Q6 to Q6e). Agent activity during the hosted outage or upgrade may be legitimate Ecoverse or Take Control work. Map hits to known jobs before treating them as compromise.
If you find signs of compromise (our advice)
- Isolate the N-central server and keep its logs and relevant disk or appliance images for investigation.
- Rotate N-central credentials and credentials for every client environment that server can reach.
- Start incident response for every managed client, not only the RMM host.
- Rebuild or restore from a known good state once the vendor upgrade is in place.
- Keep monitoring for further admin changes and unexpected remote management activity.
Offline or upgraded does not mean clean
Taking N-central offline, or upgrading it to 2026.4.1.26, stops this path going forward, but it does not undo actions already taken. Hunt the period from 8 November, and treat unexplained administrator enablement or credential changes as urgent.
N-able N-central 2026.4 HF2 FAQ
Short answers based on N-able Uptime and the official HF2 release notes, checked at 22:27 GMT on 10 November 2026.
What happened, and what is Able2Shell?
Able2Shell is the public name used when an independent security researcher disclosed critical vulnerabilities in N-able N-central. N-able is responding to that disclosure. It has now released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) and published seven related CVEs. Prefer N-able's release notes and Uptime wording over the public nickname.
Which CVEs did N-able publish, and are they in CISA KEV?
The seven CVEs are CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 and CVE-2026-91000. Titles follow N-able's official list. None of them was in CISA's Known Exploited Vulnerabilities catalogue when we checked at 22:27 GMT on 10 November 2026 (catalogue 2026.11.10, released at 19:03 UTC). We have not assigned our own severity scores. N-able describes the issues as critical. Credited to security researchers; we do not name them.
Is it being exploited?
N-able's current Uptime wording (checked at 22:27 GMT on 10 November 2026) is: 'We are now observing scanning activity associated with the published proof-of-concept code.' We do not link that code. N-able has not, in that update, stated that it has confirmed successful compromise. Do not claim compromise in your estate without your own evidence.
What is the official fix, and is that the end of it?
N-able has released N-central 2026.4 HF2, build 2026.4.1.26, which it says addresses the most critical 9 November vulnerabilities and includes further security patches. Uptime also says a follow-up hotfix will be released to provide further security updates. Upgrade to 2026.4.1.26 now, keep the server offline until the upgrade has succeeded, and watch Uptime and the HF2 notes for the follow-up hotfix.
What should on-premises customers do?
N-able strongly recommends upgrading to 2026.4.1.26 as soon as possible and continuing to keep each server offline until it has been successfully upgraded. Download the release from N-able's software downloads (SD-000143) and follow the HF2 release notes, including the supported upgrade path. Upgrade Agents first, then Probes. HF2 has a known issue: built-in remote control is temporarily disabled; Take Control still works.
What should hosted (NCOD) customers do?
N-able is upgrading all hosted regions, including trials. Access is restored as each region completes the upgrade and required validation. Hosted customers must still upgrade Agents and Probes (Agents first, then Probes). Follow the Agent and Probe upgrade guidance linked from the HF2 notes.
What should MSPs do in the next 24 hours?
Follow N-able first: upgrade to 2026.4.1.26, stay offline until that upgrade has succeeded, upgrade Agents and Probes, and watch for the follow-up hotfix. Our advice on top: inventory every instance, remove internet exposure if a server cannot be upgraded at once, plan fallback client access, hunt from 8 November on the server and managed endpoints, and prepare to rotate credentials and run incident response for every managed client if you find signs of compromise.
Does the shipped checker already mark 2026.4.1.26 as a fixed build?
No. The shipped checkers still leave FIXED_BUILDS empty, so they never return the reserved FIXED BUILD verdict. That is deliberate: a follow-up hotfix is also planned, and Agents and Probes still need upgrading. Add 2026.4.1.26 yourself if you want that verdict for the server build, and still confirm the installed build against N-able's notes.
Where do we get official updates?
Watch the N-able Uptime incident page and the N-central 2026.4 HF2 release notes on N-able Status.
Protect Your RMM Estate, and Your Clients'
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- N-able Uptime: N-central critical security incident, release available (checked 10 November 2026, 22:27 GMT)
- N-able Status: N-central 2026.4 HF2 release notes (posted and last updated 10 November 2026)
- N-able: Software Downloads SD-000143 (N-central 2026.4 HF2)
- N-able: How to upgrade Agents and Probes on N-central 2026.4 HF1 and above
- CISA: Known Exploited Vulnerabilities catalogue (catalogue 2026.11.10, checked 10 November 2026, 22:27 GMT)
Related threat guides: FortiClient CVE-2026-121529 and Microsoft November 2026 Patch Tuesday. All threat guides.