N-able has released N-central 2026.4 Hotfix 2, a critical security update that lists fixes for seven vulnerabilities following the public disclosure of the Able2Shell exploit chains. The release identifies build 2026.4.1.26 as the patched version and covers weaknesses involving XML external entity processing, OGNL injection, privilege escalation, stored cross-site scripting, server-side request forgery, file-upload path traversal and insecure inter-process communication. N-able published the official release notes on November 10.
The seven CVEs listed in the hotfix are CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 and CVE-2026-91000. The issues include multiple XXE and OGNL injection vulnerabilities, local privilege escalation to root, stored XSS in patch metadata, SSRF through service-import validation, remote code execution through a file-repository upload path traversal, and local privilege escalation through insecure IPC channels.
N-able has not said how many of the 33 flaws reported by researcher Sean Bales it was able to reproduce. CSO Online reported that the company had observed scanning activity associated with the published exploits but had not found evidence that a customer environment was successfully compromised. The hotfix release therefore confirms seven patched CVEs, not that every issue in the researcher’s disclosure has been independently validated by N-able.
N-able will upgrade hosted N-central servers itself, while customers running on-premises installations must upgrade to build 2026.4.1.26. The company also requires hosted and on-premises customers to update their Agents and Probes. Its release notes warn that mismatched component versions can interrupt Agent-to-Probe communication and temporarily disable features such as the offline patch cache. Built-in remote control is also disabled in this release, although N-able says its separate Take Control service continues to work.
The hotfix follows N-able’s decision to take hosted N-central offline worldwide and ask on-premises customers to shut down their servers after the Able2Shell disclosure, which Abijita covered in its earlier report on the N-central shutdown.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
