**N-able® N-central**

**N-able® N-central**

**N-central Critical Security Incident - Release Available**

**IMPORTANT: N-central Critical Security Incident**
N-able is currently responding to the public disclosure of critical vulnerabilities in N-central by an independent security researcher.

We are now observing scanning activity associated with the published proof-of-concept code. **We continue to recommend that N-central servers remain offline until your server has been successfully upgraded.**

**We have released N-central 2026.4 HF2, which addresses the critical security updates** and includes a number of security patches and technology updates that improve the overall security of N-central. Related CVEs have now also been published. **Please note that a follow-up hotfix will be released to provide further security updates as part of our ongoing response to the disclosure.**

**N-central Release Available**
**The N-central release addressing the most critical November 9 vulnerabilities is now available.**

Customers should review the Release Notes for important information regarding the release and remediation:
* **Release Notes:** [N-central 2026.4 HF2 Release Notes | N-able Status](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/)
* **Download Links:** [Software Downloads: SD - 000143](https://me.n-able.com/s/softwaredownloads/a9jVy0000000LUHIA2/sd-000143)


**N-central Hosted Customers**
**All N-central Hosted (NCOD) regions are currently being upgraded to the new release. This upgrade process also includes N-central Trial participants.**

N-able teams are actively managing the upgrade across the Hosted environment. Access will be restored as regions successfully complete the upgrade and required validation.

The Hosted environments had previously been taken offline as a precaution to protect customer environments while remediation was developed and validated.

**N-central On-Premises Customers**
**N-able strongly recommends that all N-central On-Premises customers upgrade to the newly released version as soon as possible.**

Please refer to the following resources for the software download and instructions required to complete your upgrade:
* **N-central Release Download**: [Software Downloads: SD - 000143](https://me.n-able.com/s/softwaredownloads/a9jVy0000000LUHIA2/sd-000143)
* **N-central Upgrade User Guide**: [https://me.n-able.com/s/article/How-to-upgrade-Agents-and-Probes-on-N-able-N-central-version-2026-4-HF1-and-above](https://me.n-able.com/s/article/How-to-upgrade-Agents-and-Probes-on-N-able-N-central-version-2026-4-HF1-and-above)

* **N-central Legacy Version User Guide**: [https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Release_Notes/upgrade_path.htmHow To Upgrade Legacy versions (2020.1 to 2022.6) to 2026.3How To Upgrade Legacy versions (2020.1 to 2022.6) to 2026.3](https://me.n-able.com/s/article/How-To-Upgrade-Legacy-versions-2020-1-to-2022-6-to-2026-3)

Customers should follow the published upgrade guidance carefully before restoring normal access to their N-central environment. Earlier incident guidance advised On-Premises customers to keep their N-central servers offline while remediation was being developed.

**CVE Details**
Additional information regarding the vulnerabilities addressed by this release is available below:

CVEs:

[CVE-2026-125883](https://www.cve.org/CVERecord?id=CVE-2026-125883) - Multiple XXE Vulnerabilities

[CVE-2026-125878](https://www.cve.org/CVERecord?id=CVE-2026-125878) - Multiple OGNL Injection vulnerabilities

[CVE-2026-125879](https://www.cve.org/CVERecord?id=CVE-2026-125879) - Local privilege escalation to root via nable-writable syslog-ng config

[CVE-2026-125880](https://www.cve.org/CVERecord?id=CVE-2026-125880) - Stored XSS via MMS3 patch metadata (admin context)

[CVE-2026-125881](https://www.cve.org/CVERecord?id=CVE-2026-125881) - Schema-hint SSRF via service import schema validation

[CVE-2026-125882](https://www.cve.org/CVERecord?id=CVE-2026-125882) - RCE via file repository upload path traversal (Credit Nate Fair, Sprocket Security)

[CVE-2026-91000](https://www.cve.org/CVERecord?id=CVE-2026-91000) - Insecure IPC Channels lead to local privilege escalation


**Thank You**

**N-able sincerely appreciates the patience, flexibility, and partnership our customers have demonstrated throughout this critical security event.**