N-able takes N-central offline after 33 flaws are disclosed

N-able has taken its N-central remote monitoring and management platform offline after the discovery of 33 alleged zero-day flaws. The company moved hosted N-central environments offline across the Americas, Europe and Asia-Pacific following disclosures by security researcher Sean Bales, who publicised the flaws and subsequent exploit code. N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) to address seven CVEs, and says further security updates are planned. In parallel, N-able warned customers running on‑premises servers to shut them down until advised otherwise.

The vulnerabilities are tracked under multiple CVEs, including CVE-2026-125883, which covers multiple XXE vulnerabilities; CVE-2026-125878 (OGNL injection); CVE-2026-125879 (local privilege escalation); CVE-2026-125880 (stored XSS via MMS3 patch metadata); CVE-2026-125881 (schema validation flaw); CVE-2026-125882 (remote code execution via file repository upload path traversal, discovered by Nate Fair of Sprocket Security) and CVE-2026-125883’s related chains.

Tenable’s researchers noted four exploit chains, with the XXE chain described as credential-free and potentially the most significant, capable of turning an unauthenticated network request into a full compromise of a central IT management system. Huntress urged organisations to review authentication activity from 8 November and to examine audit logs for secondary indicators of compromise as exploitation threat persists.