N-able releases hotfixes for N-central zero-days

N-able has released security hotfixes for zero-day vulnerabilities in its N-central remote monitoring and management (RMM) platform. The flaws were publicly disclosed over the weekend, prompting the company to take hosted N-central environments offline while it prepared patches.

The new release, N-central 2026.4 HF2, includes security patches and technology updates for some of the disclosed vulnerabilities. N-able said on Tuesday that hosted N-central servers across all regions had been upgraded. It strongly recommended that on-premises customers upgrade as soon as possible and follow its upgrade guidance before restoring normal access.

N-able has not said the flaws were exploited in attacks. Threat intelligence company Defused reported seeing internet scans for vulnerable systems and described probes involving anonymous agent sessions, appliance configuration data, and an unauthenticated remote-control endpoint. The nonprofit Shadowserver reported just over 148 N-central servers exposed online, down from 1,338 detected on Monday.

Security researcher Sean Bales disclosed the vulnerabilities and published proof-of-concept exploits in a GitHub repository called Able2Shell. He said the flaws affect N-central Appliance 2026.4.0.31, a pre-release version, and believes most or all may also affect earlier versions. The reported issues include remote code execution, authentication bypasses, credential disclosure, and other vulnerability types.

Bales told BleepingComputer he disclosed the flaws without notifying N-able, alleging the company had not patched separate issues he previously reported in another product. N-able did not address those allegations when asked, and instead issued a statement about the N-central incident.