N-central fix is out and attackers are scanning. Upgrade on-prem servers before they go back online

Yesterday we told on-prem N-central customers to keep their servers offline. N-able has now released the fix, N-central 2026.4 Hotfix 2, and says it is seeing scanning activity tied to the public exploit code. Our Tuesday story has the background.

So the advice changes. Upgrade first, then reconnect. N-able finished upgrading every hosted N-central server on Tuesday evening.

The N-central fix is out and the scanning has started. Upgrade to 2026.4 HF2 before that server touches the network again.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

N-able ships the N-central fix as scanning begins

N-able’s status page says HF2 “addresses the critical security updates” from the Able2Shell disclosure and that a follow-up hotfix will bring more fixes. It now lists seven CVEs, including CVE-2026-125883 (multiple XXE bugs), CVE-2026-125878 (OGNL injection) and CVE-2026-125882 (code execution through a file-repository upload path traversal).

N-able says it is “now observing scanning activity associated with the published proof-of-concept code” and still recommends keeping servers offline until they are upgraded. It posted at 01:04 UTC on November 11 (8:04 PM ET Tuesday) that all hosted N-central servers in every region had been upgraded.

• On-prem: N-able “strongly recommends” upgrading to 2026.4 HF2 as soon as possible.
• Hosted and on-prem: Agents and Probes must be upgraded too, per CSO Online and N-able’s upgrade guide.
• Still to come: a follow-up hotfix with further security updates.

On-prem N-central servers still waiting to come back online

Scanning usually comes right before exploitation. The exploit code has been public since Sunday, so an on-prem server that goes back online unpatched is the easiest target in this story.

CSO Online reports that Huntress warned patched servers may not show a new version number, so confirm the fix against N-able’s guidance rather than the version string. This product is a repeat target. Attackers have gone after N-central several times this year, and CSO says CVE-2026-18556 was used to deploy ransomware in August.

Install 2026.4 HF2, update agents and probes, then reconnect

• Download 2026.4 HF2 from N-able’s software downloads portal and install it while the server is still isolated.
• Upgrade Agents and Probes using N-able’s upgrade guide so they can talk to the patched server.
• Confirm the fix using N-able’s guidance, not just the version number, before you restore network access.
• Review logins, new administrator accounts, scripts and remote-access sessions from November 8 onward, across every client the server manages.
• Once the server is back, rotate administrator and technician passwords and agent registration tokens, as ThreatDefence advises via CSO Online.

Details

• Release: N-central 2026.4 Hotfix 2; follow-up hotfix promised.
• CVEs listed by N-able: CVE-2026-125883 (XXE), CVE-2026-125878 (OGNL injection), CVE-2026-125879 (root via nable-writable syslog-ng config), CVE-2026-125880 (stored XSS in patch metadata), CVE-2026-125881 (schema-hint SSRF), CVE-2026-125882 (upload path traversal to code execution), CVE-2026-91000 (insecure IPC, local privilege escalation).
• Status: scanning tied to the public PoC observed by N-able; hosted N-central upgraded in all regions as of November 11, 01:04 UTC.
• Prior 2026 N-central attacks: CVE-2026-18556 (August, ransomware) and CVE-2026-86218 (September), per CSO Online.

Hunt / verify

• Before upgrading, take a server snapshot and export logs so you keep evidence.
• Compare the administrator list with your staff list; look for any account named like a default administrator.
• Review script and automation deployments to client devices since November 8.
• Look for unexpected files in the N-central web root and outbound connections from the server to unknown hosts.

Source: N-able status: N-central critical security incident; CSO Online report

Sources

• N-able Uptime: N-central Critical Security Incident, Release Available
• N-able: How to upgrade Agents and Probes on N-central 2026.4 HF1 and above
• CSO Online: N-able N-central gets emergency fix two days after 33 exploits published
• The Hacker News: N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].