MeridianMeridian

N-able Releases Hotfixes for Multiple Zero-Day Vulnerabilities in N-central RMM Platform

N-able has issued security hotfixes addressing several zero-day vulnerabilities in its N-central remote monitoring and management platform. The flaws were publicly disclosed by researcher Sean Bales, who published proof-of-concept exploits after alleging prior reports went unaddressed. As a precaution, the company took all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions. The patches cover critical issues including remote code execution, XXE injection, OGNL injection, stored XSS, and local privilege escalation. Threat intelligence firm Defused reported active scanning and exploitation attempts against exposed servers, while Shadowserver noted a sharp drop in publicly reachable instances. On-premises customers are strongly urged to upgrade immediately following detailed guidance before restoring access.

BleepingComputerTranslated from English

Read at source

N-able has released security hotfixes to address multiple zero-day vulnerabilities affecting its N-central remote monitoring and management platform. The flaws were publicly disclosed over the weekend, prompting the company to take vulnerable hosted environments offline across multiple regions.

The incident began when independent researcher Sean Bales disclosed the vulnerabilities late Sunday, November 8, and published a GitHub repository called Able2Shell containing proof-of-concept exploits. Bales stated that the zero-days affect N-central Appliance 2026.4.0.31 and likely impact earlier versions as well. He chose to release the details without prior notification because N-able allegedly failed to patch vulnerabilities he reported in another product five to six months earlier.

As a precautionary measure, N-able took all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions. The company later confirmed that all hosted servers have been upgraded to version 2026.4 HF2, which includes patches for the most critical issues.

Patched Vulnerabilities

  • CVE-2026-125883 — Multiple XXE Vulnerabilities
  • CVE-2026-125878 — Multiple OGNL Injection vulnerabilities
  • CVE-2026-125879 — Local privilege escalation to root via nable-writable syslog-ng config
  • CVE-2026-125880 — Stored XSS via MMS3 patch metadata (admin context)
  • CVE-2026-125881 — Schema-hint SSRF via service import schema validation
  • CVE-2026-125882 — RCE via file repository upload path traversal
  • CVE-2026-91000 — Insecure IPC Channels lead to local privilege escalation

Defused reported that attackers have already begun scanning for vulnerable systems, including attempts to open anonymous agent sessions and access remote control endpoints without authentication. Shadowserver observed a significant reduction in exposed N-central servers, dropping from 1,338 to just over 148 instances.

N-able strongly recommends that all on-premises customers upgrade to the new version as soon as possible and follow published upgrade guidance before restoring normal access.

N-ableN-centralShadowserverSean BalesCVE-2026-125883
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Citrix and Ivanti Patch 19 Vulnerabilities Including Multiple Critical Flaws
Vulns & Exploits

Citrix and Ivanti Patch 19 Vulnerabilities Including Multiple Critical Flaws

Citrix and Ivanti released patches on Tuesday for 19 vulnerabilities across their products, addressing several critical- and high-severity issues. Ivanti fixed 13 flaws in five products, including two critical vulnerabilities in Cloud Services Application and Endpoint Manager that could enable remote attacks without authentication. The CSA issue tracked as CVE-2026-121683 allows attackers to add or delete trusted certificate entries, while the EPM flaw CVE-2026-121653 permits unauthenticated remote code execution via SQL injection. Citrix addressed six defects in XenServer, including CVE-2026-102705 that could expose the Pool Secret, along with mitigations for AMD CPU vulnerabilities affecting virtual machines. Neither vendor has observed active exploitation of the disclosed issues in the wild.

SecurityWeekNov 11, 2026Translated from English

Fortinet Issues 89 Advisories Fixing Nearly 100 Vulnerabilities Across Products
Vulns & Exploits

Fortinet Issues 89 Advisories Fixing Nearly 100 Vulnerabilities Across Products

Fortinet released 89 security advisories addressing nearly 100 vulnerabilities in its product lineup. The update follows the company's recent integration of frontier AI models into its security testing processes. Seventeen of the flaws are rated critical, with several enabling arbitrary code execution, authentication bypass, and other high-impact attacks. FortiMail received the largest share of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. A notable FortiClient issue named Fortinet2Shell stems from a CORS misconfiguration that allows arbitrary code execution when FortiPAM is enabled. Nearly 80 additional high-severity vulnerabilities were also resolved, covering XSS, code injection, privilege escalation, and denial-of-service conditions.

SecurityWeekNov 11, 2026Translated from English

eMudhra Revokes Eight More Intermediate CAs After Python Script Exposes RSA Keys During HSM Transfer
Vulns & Exploits

eMudhra Revokes Eight More Intermediate CAs After Python Script Exposes RSA Keys During HSM Transfer

eMudhra has revoked eight additional intermediate certificate authorities after discovering that a custom Python script exposed their RSA private keys in memory during a key ceremony. The company previously declared these CAs unaffected by the October key compromise incident. The script retrieved keys from Utimaco HSMs for transfer to Crypto4A devices but failed to demonstrate compliance with the company's CPS rules on key handling. Six of the revoked CAs were used for TLS certificates and two for code signing, affecting 195 certificates including those for universities and government entities. The incident originated from an April 2025 key ceremony where the same flawed script was used. Browsers including Microsoft, Apple, Chrome, and Firefox are accelerating the removal of trust in eMudhra's remaining roots as the company exits the public TLS market.

The Hacker NewsNov 11, 2026Translated from English