Multiple XXE issues
Multiple XML external entity issues.
N-able ships N-central hotfix after Able2Shell public exploit disclosures
N-able released N-central 2026.4 HF2 after public proof-of-concept disclosures. It reports scanning and says HF2 addresses the identified unauthenticated paths. Further fixes are pending for authenticated or conditional flaws.
- Disclosed
- Nov 9, 2026
- Public disclosure date
- Severity
- Sharted
- 7 CVEs tracked here
- Splash zone
- N-central servers, especially internet-facing on-premises installs. Hosted and on-premises customers need Agent and Probe updates.
- N-able · N-central · RMM
- In the wild
- Disputed
- N-able reports scanning linked to the PoC and no indications of hosted-server compromise.
What happened
N-able says HF2 addresses all unauthenticated paths it had identified. The remaining disclosed paths require an account, often with elevated access, or other conditions. The company lists CVE-2026-125883, CVE-2026-125878 through CVE-2026-125882, and CVE-2026-91000 in its November 11 response. Consult the vendor for per-flaw status as follow-up patches are published. Scanning of public PoCs supports L3. The vendor has not established exploitation in an individual customer environment in this update.
What’s in the bowl
Multiple OGNL injections
Several paths allow injection of OGNL expressions.
Local root escalation
A writable syslog-ng configuration enables local escalation to root.
Stored cross-site scripting
Stored script injection via MMS3 patch metadata in an admin context.
Server-side request forgery
A schema hint can influence requests during service-import schema validation.
File repository upload traversal
A repository upload traversal can lead to remote code execution.
Local privilege escalation via IPC
Insecure interprocess communication channels can elevate local privileges.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| N-central 2026.4 HF2 | 2026.4.1.26 |
Crime-scene timeline
Nov 9, 2026
Researcher publishes vulnerabilities
N-able dates the public disclosure to November 9.
Nov 10, 2026
N-able publishes HF2 release notes
Build 2026.4.1.26 supersedes 2026.4 and HF1.
Nov 11, 2026
N-able reports hosted servers back online
N-able says it patched hosted servers and is preparing another hotfix.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- N-able HF2 release notesPrimaryGives the server build, supported upgrade path and Agent/Probe compatibility requirements.
- N-able November 11 responsePrimaryDescribes public PoCs, scanning, hosted recovery and remaining work.