N-able released N-central 2026.4 HF2 after a researcher publicly disclosed flaws in its remote monitoring and management console. N-able took hosted systems offline on November 9 and told operators of on-premises servers to do the same. Its status page says all hosted regions were upgraded by November 11 at 01:04 UTC.
Evidence status: public exploit demonstrations and vendor-observed scanning, not a vendor-confirmed fleet compromise. BleepingComputer reports that the researcher tested a pre-release appliance build and demonstrated a path to administrative access and command execution. N-able says it is observing scanning associated with the published proof of concept. That does not establish successful intrusions across customers.
The vendor incident notice names seven issues addressed in HF2. They include CVE-2026-125883 (XML external entities), CVE-2026-125878 (OGNL injection), CVE-2026-125879 (local privilege escalation), and CVE-2026-125880 (stored cross-site scripting). It also lists CVE-2026-125881 (server-side request forgery), CVE-2026-125882 (file upload path traversal and code execution), and CVE-2026-91000 (local privilege escalation). These are the vendor’s listed fixes, not a claim that every publicly disclosed issue is resolved. N-able says another hotfix will follow.
What on-prem operators should do
Keep affected N-central servers offline until upgraded. N-able urges on-premises customers to install 2026.4 HF2 as soon as possible and follow its release and upgrade guidance before restoring access. Check the actual installed build and the vendor’s incident status instead of treating a download as a completed upgrade. If a server was exposed during the disclosure period, preserve access and application logs and investigate unusual administrative activity; the public notice does not specify which customer systems, if any, were breached.
Caveat: HF2 addresses the most critical disclosed issues; N-able explicitly promises a further security hotfix.
Update — November 11, 2026, 5:45 p.m. EST
N-able’s new security-response statement, linked from its incident status at 21:53 UTC, adds two operational details: hosted servers are back online, and both hosted and on-premises customers must upgrade their Agents and Probes. The original guidance above focused on the N-central server; operators should now check the components it manages as well. N-able still says on-premises servers should remain inaccessible from the internet until HF2 is installed.
The vendor says HF2 addresses all the identified flaws exploitable without authentication. It says remaining issues require an authenticated account, often with elevated privileges, or other limiting conditions; further hotfixes are planned. This is N-able’s assessment, not an independent validation of every publicly claimed defect.
N-able reports scanning associated with the public proof of concept, but no indications of compromise on its hosted N-central servers. It says determining whether a particular customer’s environment was compromised requires an individual assessment. That statement does not establish that on-premises systems were unaffected.