GoKawiilN-able patches N-central zero-days after weekend disclosure forced outage
N-able released N-central 2026.4 HF2 to fix several zero-day vulnerabilities in its N-central remote monitoring platform, including critical bugs like RCE via path traversal, privilege escalation, SSRF and stored XSS. The flaws were publicly disclosed by an independent researcher late Sunday, prompting N-able to take all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific while it developed fixes. N-able said all hosted servers have now been upgraded and urged on-premises customers to update immediately.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how quickly a public vulnerability disclosure can force a vendor to shut down live customer infrastructure to prevent exploitation, especially for an RMM tool widely used by managed service providers with broad access to client networks. Because N-central sits at the center of many organizations' IT management, unpatched on-premises installations could remain attractive targets for attackers until administrators apply the hotfix.
- N-able shipped N-central 2026.4 HF2 patching multiple critical zero-days, including an RCE flaw.
- The vulnerabilities were disclosed non-responsibly by an independent researcher, prompting an emergency shutdown of hosted environments.
- All hosted N-central servers are now upgraded, but on-premises customers still need to apply the patch themselves.
Source: bleepingcomputer.com, 2026-11-11
Published there as: “N-able releases security hotfixes for zero-day vulnerabilities”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.