N-able has released a critical N-central hotfix that temporarily disables the platform's built-in remote control, after researcher Sean Bales published 33 alleged zero-days with proof-of-concept (PoC) code.

N-able detailed N-central 2026.4 Hotfix 2, build 2026.4.1.26, in its November 10 release notes, describing the update as a critical security release for its remote monitoring and management (RMM) platform.

The Able2Shell disclosure, published November 9, described four exploit chains that Bales said ended in code execution on an N-central server, two of them with root privileges and one he called credential-free. He said he tested the flaws on a pre-release build and that most if not all should work on earlier versions, including the current release.

Hotfix Covers Seven CVEs and Disables Remote Control

N-able took hosted N-central offline on November 9 as a precaution and told on-premises customers to keep their servers offline until they were updated.

Hotfix 2 addresses seven CVEs covering XML external entity (XXE) flaws, Object-Graph Navigation Language (OGNL) injection, privilege escalation, stored cross-site scripting, server-side request forgery and remote code execution through path traversal.

The seven records are CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 and CVE-2026-91000. CVE-2026-125882 credits Nate Fair of Sprocket Security.

Remote control will be re-enabled in a future fix, according to the release notes, which also tell customers to update agents and probes after upgrading. N-able told Infosecurity that hosted environments have been upgraded and are back online.

N-able said the release addresses "the most critical November 9 vulnerabilities" and that a follow-up hotfix will bring further security updates.

Read more on N-central: N-able Releases Hotfix for Critical Remote Code Execution Vulnerability

N-able Disputes Disclosure as Exploitation Attempts Emerge

N-able said it was seeing scanning activity linked to the published PoC code.

Security firm WatchTowr saw exploitation attempts against its N-central honeypots overnight after the disclosure, according to an advisory updated November 10 by Beazley Security, the cybersecurity arm of insurer Beazley. The systems were decoys, not customer environments.

N-able said claims that it had ignored responsible disclosure from Bales were inaccurate, and that the vulnerabilities published on November 9 had not been disclosed through its established reporting channels.

Speaking to Infosecurity, Bales confirmed that N-able's account was accurate and that he had not disclosed any of the vulnerabilities to the company, adding that he believed the claim N-able had ignored him came from an outdated README he has since changed. He argued that publishing "makes vendors safer by forcing them to fix problems as fast as possible."

N-able president and CEO John Pagliuca took the opposite view, arguing that "publishing exploit code before customers have had the chance to act doesn't make anyone safer. It hands attackers a head start," he told Infosecurity.

Neither the release notes nor N-able's statement say how the seven CVEs map to the 33 Able2Shell issues, and PoC code for all 33 remains public.