N-able N-central: Remote code inclusion via unsigned upgrade package

Summary

N-able N-central, a remote monitoring and management platform used by MSPs and IT teams, downloads code without an integrity check, which allows remote code inclusion. The CNA record gives the affected range as through 24.6.1, and the CVSS rating assumes an attacker with high privileges. Researchers report that the related Able2Shell chain may be reachable with less access and that a pre-release build was also affected, so the exposure may be larger than the CVE range suggests.

Affected

• N-able N-central through 24.6.1 according to the CNA record (default: unaffected)
• Researchers report that the public Able2Shell tests used build 2026.4.0.31 and that earlier builds may also be affected
• Triskele Labs advises treating all on-premises servers as affected, including those at 2026.3 Hotfix 4 (build 2026.3.1.14), until N-able confirms otherwise
• Hosted N-central environments are reported to be offline

Fixed in

Unknown. No fixed version has been published in the sources available at the time of writing. The N-able advisory could not be opened for verification.

Workaround

• N-able advises taking on-premises servers offline until it confirms they are safe to restore
• If a server must stay online, remove all internet exposure of the N-central web interface (third-party recommendation, not documented by the vendor)
• Apply only N-able's official hotfix once released, and confirm the fixed build in the release notes

Exploitation

• N-able reports no signs of active exploitation of these vulnerabilities
• N-able reports scanning activity associated with published proof-of-concept code, with no evidence of successful exploitation in customer environments
• A public proof-of-concept exists for the related Able2Shell chain; it has not been verified against this specific CVE
• Not listed in CISA KEV as of November 10, 2026

Our recommendation

• Inventory all N-central instances, hosted and on-premises, and check for internet exposure
• Keep on-premises servers offline or behind a VPN or firewall until N-able publishes a validated hotfix
• Apply the hotfix only from N-able's official channels and verify the fixed build
• Review audit logs and administrator accounts for unexpected changes
• Ask your MSP whether they use N-central and what their status is

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• N-able security advisory CVE-2026-125958 me.n-able.com
• The Hacker News: N-able takes hosted N-central offline thehackernews.com
• Triskele Labs: N-central Able2Shell zero-days take on-premises servers offline www.triskelelabs.com
• OffSeq Radar: CVE-2026-125958 radar.offseq.com
• Strix: CVE-2026-125958 www.strix.ai
• CVE Threat Intelligence: CVE-2026-125958 cve.threatint.com
• Brandefense: N-able Able2Shell zero-days brandefense.io
• Ostorlab: N-central RCE, 33 zero-days (Able2Shell) blog.ostorlab.co

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:47.