N-central Vulnerabilities: Upgrade to Hotfix 2, Disable Legacy API

N-able is seeing scanning activity tied to published proof-of-concept code for N-central vulnerabilities, and recommends that N-central servers stay offline until they are upgraded to 2026.4 Hotfix 2 (build 2026.4.1.26), which fixes 7 CVEs. If you run N-central on your own servers, upgrade now and turn off the Legacy API if it is on.

Sources checked 12 November 2026.

N-central is a remote monitoring and management (RMM) platform: managed service providers (MSPs) use it to look after their customers' computers from one console. That reach is why a flaw in it matters to more than one organisation.

What happened

N-able's status dashboard (incident 202584, from 9 November 2026) says it is "responding to the public disclosure of critical vulnerabilities in N-central by an independent security researcher." It adds: "We are now observing scanning activity associated with the published proof-of-concept code." Scanning means someone is searching the internet for servers to target; N-able has not said any were broken into.

"The Hosted environments had previously been taken offline as a precaution", and N-able is upgrading the hosted regions.

On 10 November 2026 N-able released the fix, N-central 2026.4 HF2, which it calls "a critical security update". It lists these CVEs, in N-able's words:

CVE	N-able's description
CVE-2026-125882	RCE via file repository upload path traversal
CVE-2026-125878	Multiple OGNL Injection vulnerabilities
CVE-2026-125883	Multiple XXE Vulnerabilities
CVE-2026-125881	Schema-hint SSRF via service import schema validation
CVE-2026-125880	Stored XSS via MMS3 patch metadata (admin context)
CVE-2026-125879	Local privilege escalation to root via nable-writable syslog-ng config
CVE-2026-91000	Insecure IPC Channels lead to local privilege escalation

RCE, remote code execution, means an attacker can run their own commands on the server. N-able credits CVE-2026-125882 to Nate Fair of Sprocket Security. N-able says "a follow-up hotfix will be released".

A second disclosure on 12 November 2026 (incident 202609) claims more vulnerabilities in On-Premises 2026.4.1 HF2. N-able says the issue "depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet." Hosted N-central is not affected.

Who is affected by the N-central vulnerabilities

On-premises N-central: you upgrade the server yourself, directly from 2025.4 or later; older versions must first move to a supported one.
Hosted N-central: N-able upgrades the server.
Everyone: Agents and Probes must be upgraded, hosted or on-premises.

What to do now

Keep on-premises servers offline until upgraded to 2026.4.1.26, as N-able recommends.
Turn off the Legacy API. N-able says on-premises customers with it enabled should disable it now; everyone else should confirm it is disabled.
Upgrade Agents first, then Probes. N-able says an upgraded Probe cannot talk to Agents that haven't been upgraded. Built-in remote control is temporarily disabled; Take Control still works.
Check for misuse. N-able lists no indicators; as general good practice, review admin accounts, new scripts and unexplained console logins.
Watch for the follow-up hotfix, and tell your customers what you changed. If an MSP manages your computers, ask whether Hotfix 2 is installed.

An RMM console can run software on every device it manages, so treat its provider as a top-tier vendor in your third-party risk programme. For moving a fix through in days, see our emergency patching plan.

Sources

N-able: Status dashboard, incidents 202584 (from 9 November 2026) and 202609 (from 12 November 2026), last updated 12 November 2026
N-able: N-central 2026.4 HF2 Release Notes, 10 November 2026, read 12 November 2026
Leads only, not sources: news reports from SecurityWeek and BleepingComputer, November 2026