N-able has warned that attackers are actively scanning for vulnerable N-central servers after proof-of-concept (PoC) code related to critical flaws in its remote monitoring and management (RMM) platform was published. The company declared a major outage incident on November 9, 2026, and reported increased scanning activity tied to the released PoC.
The disclosure of the PoC occurred without the vendor’s involvement. N-able previously described the situation as “non-responsible” and temporarily took hosted environments offline as a precaution. The vendor has advised on-premises customers to keep their servers offline until they complete the necessary upgrades.
N-central patches and CVEs
N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) and published seven CVEs covering XML external entity (XXE) flaws, OGNL injection bugs, a stored cross-site scripting (XSS) issue, a server-side request forgery (SSRF) issue, and two local privilege escalation paths. The most serious is CVE-2026-125882, a remote code execution flaw caused by path traversal in the file repository upload function; Nate Fair of Sprocket Security was credited for that finding.
The other six CVEs are:
– CVE-2026-125883: multiple XXE vulnerabilities.
– CVE-2026-125878: multiple OGNL injection vulnerabilities; Object-Graph Navigation Language injection has caused remote code execution in other Java products.
– CVE-2026-125879: local privilege escalation to root through a writable syslog-ng configuration.
– CVE-2026-125880: stored XSS through MMS3 patch metadata, in an admin context.
– CVE-2026-125881: SSRF through service import schema validation.
– CVE-2026-91000: local privilege escalation through insecure inter-process communication (IPC) channels.
N-able said a follow-up hotfix will deliver further security updates.
Impact, history and recommended upgrades
An RMM server controls many downstream endpoints, so a compromise can give attackers a path into every managed customer. N-central has been attacked before: attackers exploited CVE-2026-18577 to gain administrative control and abuse the Take Control feature. CISA later added that flaw to its Known Exploited Vulnerabilities catalog. In those prior intrusions, attackers also registered Cloudflare Tunnel services for persistence.
N-able confirmed on November 11, 2026, at 01:04 UTC that all hosted N-central (NCOD) servers in every region had been upgraded; on-premises administrators must upgrade themselves. Supported direct upgrade paths run from 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1 to 4, and 2026.4 (including Hotfix 1). Earlier versions must first move to a supported build.
Both hosted and on-premises customers must also upgrade Agents and Probes; N-able advises upgrading Agents first and Probes second. A Probe on 2026.4.1.26 or later cannot talk to Agents that are not also upgraded, and features such as the offline patch cache stop working. The built-in remote control is temporarily disabled, though Take Control still works.
