N-able N-central: Local privilege escalation to root via syslog-ng configuration
Summary
N-able N-central, a remote monitoring and management (RMM) platform used by managed service providers, contains an incorrect privilege assignment in a syslog-ng configuration file that is writable by the nable user. A local attacker with existing code execution as the nable service account can escalate privileges to root. The CVSS vector requires high privileges (PR:H). Because MSPs manage customer networks through N-central, a compromised server can expose many customer environments.
Affected
- N-central versions before 26.4.1 (CVE record: affected 0 to < 26.4.1)
Fixed in
- N-central 2026.4 Hotfix 2 (build 2026.4.1.26), according to the vendor release notes
- Unknown: whether earlier branches such as 2026.3.x receive a fix for this CVE
Workaround
- No separate workaround known. The vendor recommends patching.
- Isolate unpatched on-premises N-central servers from the internet until they are updated.
Exploitation
- Public proof-of-concept code exists as part of the Able2Shell disclosure of 33 issues.
- Reports on active exploitation conflict. N-able reported scanning activity but no confirmed customer compromise. watchTowr observed exploitation attempts against honeypots.
- Not listed in the CISA KEV catalog at the time of research.
Our recommendation
- Confirm the build of every N-central server and update on-premises servers to 2026.4 HF2 (build 2026.4.1.26) or later.
- If patching is delayed, take affected servers offline or isolate them.
- Review authentication logs from 8 November 2026 onward, as well as administrator accounts and newly deployed scripts.
- Treat any exposed, unpatched server as potentially compromised and review the managed customer networks it connects to.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- N-able security advisory (vendor) me.n-able.com
- N-central 2026.4 HF2 release notes status.n-able.com
- Huntress: N-able vulnerability exploitation www.huntress.com
- Ostorlab: N-central RCE and Able2Shell chains blog.ostorlab.co
- Rapid7: N-central critical vulnerabilities www.rapid7.com
- CSA research note: Able2Shell N-central zero-days labs.cloudsecurityalliance.org
- CSO Online: N-central emergency fix www.csoonline.com
- Cybersecurity News: N-central servers taken offline cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:04.
Original description (NVD)
Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 26.4.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.