N-able says N-central 2026.4 Hotfix 2 resolves the disclosed vulnerabilities exploitable without authentication, according to SecurityWeek. Its hosted environments have also been upgraded and brought back online, the company told Infosecurity Magazine. But the patch checklist isn’t ready for the bin: further fixes are pending, and even hosted customers still have updates to install. Source Source Source
N-central gives IT departments and managed service providers a central web console for monitoring and managing client networks and devices. N-able took its hosted environments offline on November 9 as a precaution after researcher Sean Bales publicly released the Able2Shell collection of alleged vulnerabilities and proof-of-concept exploit code. It also advised on-premises customers to disconnect their servers while remediation was developed. Source
In a statement quoted by SecurityWeek, N-able said it was observing scanning associated with the published exploit code, but had seen “no indications of compromise within N-central hosted servers.” That finding is limited to the company’s hosted servers, not every customer deployment. Source
Infosecurity Magazine also reported that WatchTowr saw exploitation attempts against N-central honeypots, citing a Beazley Security advisory. Those systems were decoys, not customer environments; the attempts do not establish a successful customer breach. Source
Hosted doesn’t mean hands-off
N-able’s November 10 release notes identify HF2 as build 2026.4.1.26 and call it a critical security update. The notes list seven fixed CVE records, covering issues including remote code execution, privilege escalation and injection flaws. Source
- On-premises customers: Upgrade your own servers as soon as possible, following N-able’s supported upgrade path and guidance before restoring normal access. Older installations may need an intermediate upgrade first. Source Source
- Hosted customers: N-able handles the server upgrade, but you must still upgrade your Agents and Probes. The server coming back online does not close your ticket. Source
For both groups, N-able says to upgrade Agents first, then Probes to preserve communication. An upgraded Probe can’t communicate with an Agent unless both the Agent and Patch Management Engine run build 2026.4.1.26 or later. Without that connection, features such as the offline patch cache are unavailable. N-able says the updated engine is pushed automatically and requires no customer action. Source
Built-in remote control is temporarily disabled, according to N-able’s release notes. The company says Take Control continues to work as expected and that built-in remote control will return in a future fix, but gives no restoration date. Source
More fixes are coming
N-able says the remaining vulnerabilities require an authenticated N-central account, often with elevated privileges, or additional conditions that limit exploitability. It plans to address them through subsequent hotfixes. Source
The published numbers don’t provide a tidy progress bar, either. Infosecurity Magazine reports that neither N-able’s release notes nor its statement explains how the seven fixed CVEs map to the 33 alleged Able2Shell issues. Subtracting seven from 33 would not produce a reliable count of outstanding vulnerabilities. Source Source
Comments