N-able N-central flaws published without warning could let attackers take over IT management servers (CVE-2026-125883)

12 November 2026Critical 9.3

N-able · N-able N-central · CVE-2026-125883

N-able N-central flaws published without warning could let attackers take over IT management servers

On 8 November a researcher published more than 30 flaws in N-central, the remote management platform many IT providers use to look after their customers' computers, without telling N-able first. The most serious chain starts with CVE-2026-125883 (CVSS 9.3), needs no login, and ends with commands running on the server and a new administrator account. N-able took its hosted service offline on 9 November and released a hotfix on 10 November. It said it had not observed active exploitation, but it has since seen attempts to scan for the flaws.

Affected: N-able N-central before 2026.4 HF2 (build 2026.4.1.26). The hotfix covers seven CVEs: CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 and CVE-2026-91000. BleepingComputer reports that this is some, not all, of what the researcher published. Hosted N-central servers have been upgraded by N-able; on-premises servers have to be upgraded by whoever runs them.
What to do: On-premises: upgrade the N-central server to 2026.4 HF2 (build 2026.4.1.26) as soon as possible; N-able supports upgrading from 2025.4 and later builds, and had advised keeping servers offline until a fix was in place. Hosted and on-premises alike: upgrade Agents first, then Probes. If an IT provider looks after your computers, ask whether they use N-central and whether the server, Agents and Probes are all on the hotfix.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Widely covered; full details were made public before a fix existed, and the product gives IT providers remote control of their customers' machines.

N-able N-central flaws published without warning could let attackers take over IT management servers

Affected

N-able N-central before 2026.4 HF2 (build 2026.4.1.26). The hotfix covers seven CVEs: CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 and CVE-2026-91000. BleepingComputer reports that this is some, not all, of what the researcher published. Hosted N-central servers have been upgraded by N-able; on-premises servers have to be upgraded by whoever runs them.

What to do

On-premises: upgrade the N-central server to 2026.4 HF2 (build 2026.4.1.26) as soon as possible; N-able supports upgrading from 2025.4 and later builds, and had advised keeping servers offline until a fix was in place. Hosted and on-premises alike: upgrade Agents first, then Probes. If an IT provider looks after your computers, ask whether they use N-central and whether the server, Agents and Probes are all on the hotfix.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Widely covered; full details were made public before a fix existed, and the product gives IT providers remote control of their customers' machines.