SecurityWeekIonut Arghire
Attackers Probe N-able N-central Zero-Days After Disclosure
Part of the CVE-2026-125883 story · since 9 Nov
- Mon 9 Nov, 22:46 UTC. cybersixt, first report. N-able N-central hotfix hit by new public zero-day exploits.
- Wed 11 Nov, 10:30 UTC. SecurityOnline, its first report on the story. N-able patches seven N-central flaws as attackers scan servers.
- Wed 11 Nov, 18:00 UTC. Infosecurity, its first report on the story. N-able patches N-central after 33 exploit proofs go public.
- Wed 11 Nov, 21:00 UTC. Dark Reading, its first report on the story. N-able takes N-central offline after 33 flaws are disclosed.
- Thu 12 Nov, 10:30 UTC. SecurityWeek, its first report on the story. Attackers Probe N-able N-central Zero-Days After Disclosure. This article, 5th of 5.
SecurityWeek reports that attackers have begun actively probing N-able N-central installations after researcher Sean Bales released details and PoCs for more than 30 zero-days, dubbed Able2Shell. N-able subsequently pushed out patches for the most serious unauthenticated flaws and temporarily took on-premises N-central environments offline while fixes were developed; hosted environments were brought back online once safeguards were in place.
N-able says the vulnerabilities that could be exploited without authentication have been resolved, with remaining issues requiring an authenticated account or additional conditions to exploit and to be addressed in follow-up hotfixes. Defused Cybersecurity notes initial scanning began soon after the publication of the flaws, including anonymous agent sessions and an attempt to reach the remote-control endpoint without authentication.
The patched flaws include CVE-2026-125883 (multiple XXE issues, CVSS 9.3), CVE-2026-125878 (XSS, CVSS 8.7), CVE-2026-125879 (privilege escalation, CVSS 8.6), CVE-2026-125880 (XSS, CVSS 8.3), CVE-2026-125881 (SSRF, CVSS 9.3), CVE-2026-91000 (missing authentication leading to privilege escalation, CVSS 8.4), and CVE-2026-125882 (path traversal to remote code execution, CVSS 8.6) as part of N-central 2026.4 HF2.
The firm notes attackers are already probing exposed instances, while reiterating that no compromise of hosted N-central servers has been observed. N-able also disputed Bales’s claim of ignoring responsible disclosure, citing that the researcher did not use established reporting channels for the dropped vulnerabilities. Written by Ionut Arghire, SecurityWeek, 12 November 2026.
How the story developed
5 articles from 5 outlets since 9 Nov. Still developing; the latest report was 3 hours ago. This was the 5th report, 2 days after the first.
- Mon 9 Nov, 22:46 UTC. cybersixt, first report. N-able N-central hotfix hit by new public zero-day exploits.
- Wed 11 Nov, 10:30 UTC. SecurityOnline, its first report on the story. N-able patches seven N-central flaws as attackers scan servers.
- Wed 11 Nov, 18:00 UTC. Infosecurity, its first report on the story. N-able patches N-central after 33 exploit proofs go public.
- Wed 11 Nov, 21:00 UTC. Dark Reading, its first report on the story. N-able takes N-central offline after 33 flaws are disclosed.
- Thu 12 Nov, 10:30 UTC. SecurityWeek, its first report on the story. Attackers Probe N-able N-central Zero-Days After Disclosure. This article, 5th of 5.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 5 articles as a listHide the list
- Mon 9 NovDay 01
- N-able N-central hotfix hit by new public zero-day exploits22:46 · cybersixt · First report
- Wed 11 NovDay 23
- N-able patches seven N-central flaws as attackers scan servers10:30 · SecurityOnline
- N-able patches N-central after 33 exploit proofs go public18:00 · Infosecurity
- N-able takes N-central offline after 33 flaws are disclosed21:00 · Dark Reading
- Thu 12 NovDay 31
- Attackers Probe N-able N-central Zero-Days After Disclosure10:30 · SecurityWeek · This article, 5th of 5