Infosecurity
N-able patches N-central after 33 exploit proofs go public
Part of the CVE-2026-125883 story · since 9 Nov
- Mon 9 Nov, 22:46 UTC. cybersixt, first report. N-able N-central hotfix hit by new public zero-day exploits.
- Wed 11 Nov, 10:30 UTC. SecurityOnline, its first report on the story. N-able patches seven N-central flaws as attackers scan servers.
- Wed 11 Nov, 18:00 UTC. Infosecurity, its first report on the story. N-able patches N-central after 33 exploit proofs go public. This article, 3rd of 5.
- Wed 11 Nov, 21:00 UTC. Dark Reading, its first report on the story. N-able takes N-central offline after 33 flaws are disclosed.
- Thu 12 Nov, 10:30 UTC. SecurityWeek, its first report on the story. Attackers Probe N-able N-central Zero-Days After Disclosure.
N-able has issued what it calls a critical security hotfix for its N-central platform after Sean Bales published a repository of 33 alleged zero-days with PoC code. The company released N-central 2026.4 Hotfix 2, build 2026.4.1.26, framing the update as a fix for the most critical November 9 vulnerabilities and temporarily disabling the platform’s built‑in remote control while users upgrade.
The hotfix covers seven CVEs linked to multiple flaw classes, including XML external entity (XXE) flaws, OGNL injection, privilege escalation, stored cross-site scripting (XSS), server-side request forgery (SSRF) and remote code execution via path traversal. The CVE list comprises CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 and CVE-2026-125?00 (the Beazley advisory notes CVE-2026-91000 as credited to Nate Fair of Sprocket Security).
N-able reported hosted customers have been brought back online after upgrading, and on-premises instances were advised to remain offline until patching is complete.
Security researchers and researchers’ disclosures remained at issue however, with Beazley Security and WatchTowr noting exploitation attempts tied to the published PoC. N-able stated that it did not ignore responsible disclosure and that the vulnerabilities published on 9 November had not been disclosed through its formal channels; Bales countered that the PoC disclosures were meant to accelerate fixes.
N-able’s leadership, including president and CEO John Pagliuca, characterised publishing exploit code before customer action as risky, arguing it gives attackers a head start, while Bales argued the opposite, saying the publication helps vendors respond faster. PoC code for all 33 Able2Shell issues remains public.
How the story developed
5 articles from 5 outlets since 9 Nov. Still developing; the latest report was 3 hours ago. This was the 3rd report, 2 days after the first.
- Mon 9 Nov, 22:46 UTC. cybersixt, first report. N-able N-central hotfix hit by new public zero-day exploits.
- Wed 11 Nov, 10:30 UTC. SecurityOnline, its first report on the story. N-able patches seven N-central flaws as attackers scan servers.
- Wed 11 Nov, 18:00 UTC. Infosecurity, its first report on the story. N-able patches N-central after 33 exploit proofs go public. This article, 3rd of 5.
- Wed 11 Nov, 21:00 UTC. Dark Reading, its first report on the story. N-able takes N-central offline after 33 flaws are disclosed.
- Thu 12 Nov, 10:30 UTC. SecurityWeek, its first report on the story. Attackers Probe N-able N-central Zero-Days After Disclosure.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 5 articles as a listHide the list
- Mon 9 NovDay 01
- N-able N-central hotfix hit by new public zero-day exploits22:46 · cybersixt · First report
- Wed 11 NovDay 23
- N-able patches seven N-central flaws as attackers scan servers10:30 · SecurityOnline
- N-able patches N-central after 33 exploit proofs go public18:00 · Infosecurity · This article, 3rd of 5
- N-able takes N-central offline after 33 flaws are disclosed21:00 · Dark Reading
- Thu 12 NovDay 31
- Attackers Probe N-able N-central Zero-Days After Disclosure10:30 · SecurityWeek