N-able N-central: critical vulnerabilities

N-able N-central

N-able took hosted N-central offline after a researcher published proof-of-concept code, then released N-central 2026.4 HF2.

Do this now

Upgrade N-central to 2026.4 HF2 before bringing any instance back online.

Who should check: teams running Remote access

Fix it

N-able N-central

On 2026.xUpgrade to N-able N-central 2026.4 HF2
Further security updates in a follow-up hotfix

The N-central release addressing the most critical November 9 vulnerabilities is now available. (vendor advisory)

First seen: 10 Nov 2026
Last update: 11 Nov 2026, 17:18 UTC
Fixed in: 2026.4 HF2
Source: news
On the menu as: Remote access

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## N-able N-central: critical vulnerabilities
Severity: critical. Patch status: partial fix.
Affected: N-able N-central
Fixed in: 2026.4 HF2

N-able took hosted N-central offline after a researcher published proof-of-concept code, then released N-central 2026.4 HF2.

## Steps
1. This touches infrastructure (remote-support). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: N-able N-central: 2026.4 HF2. No fix yet on N-able N-central. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| N-able N-central | fixed | 2026.4 HF2 | — |
| N-able N-central | no fix yet | — | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html https://www.securityweek.com/n-able-takes-n-central-offline-as-researcher-drops-over-30-zero-days/ https://www.infosecurity-magazine.com/news/n-able-n-central-able2shell-0day/ https://www.darkreading.com/endpoint-security/n-able-n-central-offline-33-flaws
https://pwned.coffee/i/n-able-n-central-33-zero-days

Timeline

11 Nov 2026, 17:18 UTC
Fix status: no fix yet → partial fix.
10 Nov 2026, 10:17 UTC
Fix status: unknown → no fix yet.
10 Nov 2026, 10:17 UTC
Reported by securityweek.com: N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
10 Nov 2026, 07:18 UTC
Fix status: no fix yet → unknown.
10 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Checked by hand “N-able status page, incident 202584 (read 11 Nov 2026, 14:52 UTC): "N-able is currently responding to the public disclosure of critical vulnerabilities in N-central by an independent security researcher."” source
Fix by release line: Product Affected Fixed in Source
N-able N-central before 2026.4 HF2 2026.4 HF2 Checked by hand checked 11 Nov
N-able N-central all further security updates in a follow-up hotfix Checked by hand checked 11 Nov
Score: Severity critical, checked by hand: N-able status page, incident 202584 (read 11 Nov 2026, 14:52 UTC): "N-able is currently responding to the public disclosure of critical vulnerabilities in N-central by an independent security researcher."
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Fixed in	Source
N-able N-central	before 2026.4 HF2	2026.4 HF2	Checked by hand checked 11 Nov
N-able N-central	all	further security updates in a follow-up hotfix	Checked by hand checked 11 Nov

Sources: KEV – CVE record – Vendor ✓

Sources

Follow on X

Totalone very hot coffee