For: MSPs (managed service providers) and in-house IT teams that run N-able N-central, on-premises or hosted. This article is based on N-able's official status page, release notes and blog, and on public information from security companies. It does not cover attack steps.
続報待ち：この記事は公式発表に合わせて更新します
- Who is affected
MSPs (managed service providers) and in-house IT teams that run N-able N-central, on-premises or hosted.
- Confirmed so farSee the table ↓
- Fix for the first published set
- Hosted update
- Scanning tied to the test code
2 more
- Indicators of compromise
- November 12 advisory wording
Listed as possibly affected
- Compromise of HF2 servers
- Nature of the exploitation
- Not yet confirmed
- A further hotfix for the newer chain (N-able says it will release one; no date given)
- The number of compromised servers and customers (N-able has not published one; 21+ is Company A's report)
- Whether any compromise spread to customer endpoints (none reported as far as we could confirm)
1 more
- When restricted features and the Intune integration will return on hosted N-central
- What to do nowSee the steps ↓
- Check the server version and apply the HF2 fix
- Confirm the Legacy API is disabled
- Check that the console and API are not exposed to the internet
3 more
- Check whether you were compromised
- If you use the Intune integration, note that it is paused
- Watch the status page and apply the further hotfix when it is out
- Where to verify (source)All sources ↓
- N-able, "Status Dashboard" (N-central Critical Security Incident and other notices; updated 23:59 UTC on November 13, 2026; official status page, English; checked November 14)
- Last checked
- as of November 14, 2026
Follow-up plans and what we checked
N-able's status page says it is making progress toward safe restoration, that the investigation is a top priority, and that the situation is evolving with updates to be posted there. The status page we checked on November 14 was last updated at 23:59 UTC on November 13.
What N-central administrators should do today
Check the server version and apply the HF2 fix
On November 10, N-able released N-central 2026.4 HF2 (build 2026.4.1.26). It addresses seven CVEs (CVE-2026-125878 to 125883 and CVE-2026-91000), covering XXE, OGNL injection, privilege escalation and remote code execution through file upload.
- Hosted: N-able has upgraded all regions (November 11, 01:04 UTC). No server-side action is needed
- On-premises: upgrade the server to HF2. Supported source versions are 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 (HF1 to HF4), 2026.4 (build .27) and 2026.4 HF1 (build .32). Older versions must first go through N-able's upgrade path to a supported one
- Everyone: also upgrade Agents and Probes. Upgrade Agents first, then Probes. Upgrading a Probe first temporarily interrupts Agent communication
- HF2 temporarily disables the built-in remote control (Take Control still works)
Confirm the Legacy API is disabled
In its November 12 advisory, N-able asks on-premises customers to "ensure Legacy API access is disabled." It is disabled by default. If you enabled it, follow N-able's guide titled How to Disable Legacy API settings on On-Premises N-central servers. For hosted N-central, N-able turned the Legacy API off by default.
If you truly need it, keep it off the internet. Company B warns against relying on IP allowlisting alone, because the affected endpoints are the same ones Agents and Probes use to check in.
Check that the console and API are not exposed to the internet
An N-central server can run scripts on every endpoint it manages, so a compromise has a large impact (a general point). If nobody needs to reach the console from outside, put it behind a VPN. Allow only the traffic Agents and Probes need (our view).
N-able had advised keeping on-premises servers offline until HF2 was applied (November 11 blog), and on November 12 said it was "not advising customers to take N-central offline." Which applies depends on whether you have HF2 and the Legacy API disabled, so read the latest guidance on the status page.
Check whether you were compromised
- Compare the indicators of compromise N-able posted on its status page (November 13, 13:40 UTC update; URLs, destination IP addresses and ports) with your firewall and server logs. They apply to customers who have not disabled the Legacy API
- Company B's guidance (as of November 13): look for unexpected admin accounts, scripts, scheduled tasks and remote sessions since November 11. On Windows endpoints, look for unexpected PowerShell or cmd.exe launched by the N-able Agent or Probe, and unexpected restarts of the Windows Software Probe service
- If you find suspicious activity, contact N-able Support and your incident response team. MSPs should also assess the impact on managed customer environments
If you use the Intune integration, note that it is paused
In its November 12 advisory, N-able turned off the Intune integration as a precaution (for hosted, N-able did it; for on-premises, support will contact you if it could not). No restoration date is given. If your operations depend on it, prepare an alternative procedure.
Watch the status page and apply the further hotfix when it is out
N-able says it will release a further hotfix. Subscribe to notifications on the status page (uptime.n-able.com) and apply it on top of HF2 when published. Until then, disabling the Legacy API and limiting exposure are the main defenses.
What happened (from N-able's statements and press reports)
"N-able's statements" below come from the company's own status page, release notes and blog. Times are UTC. Information from security companies is attributed to its source: Company A (cited by the press) and Company B (the blog we cite).
Nov 9
An independent researcher published many N-central vulnerabilities and test code (according to N-able's blog; nicknamed Able2Shell).Nov 9
N-able took hosted N-central offline and told on-premises customers to keep their servers offline (status page).Nov 10
N-able released the fix N-central 2026.4 HF2 (build 2026.4.1.26) (release notes).Nov 11
All hosted regions were upgraded (01:04). In a blog post, N-able said it was observing scanning tied to the test code, that it saw no indications of compromise on hosted servers, and that it would release a further hotfix.Nov 11 night to 12
The researcher published a second set of test code against HF2 (press reports differ on whether this was the night of November 11 or November 12).Nov 12
In an advisory, N-able announced precautions, including confirming the Legacy API is disabled and pausing the Intune integration, and wrote that, as of that time, it had seen no signs of compromise from the new vulnerabilities (16:00). According to press reports, Company A confirmed 21 mining programs running that day.Nov 13
N-able updated that it had identified indicators and was working with the specific customers (03:50), and published indicators of compromise for customers who have not disabled the Legacy API (13:40).
- Fix
- N-central 2026.4 HF2 (build 2026.4.1.26). CVE-2026-125878 (OGNL injection), 125879 (privilege escalation to root), 125880 (stored XSS), 125881 (SSRF), 125882 (remote code execution via file upload path), 125883 (XXE), 91000 (insecure inter-process channels leading to privilege escalation). Removes legacy MDM and changes Agent and Probe communication
- Known issue
- Built-in remote control temporarily disabled (Take Control still works). To return in a future fix
- Awareness of exploitation
- Observed scanning tied to the published test code (status page). The November 12 advisory said that, as of that time, it had seen no signs of compromise from the new vulnerabilities. On November 13 it updated that it had identified indicators and was working with the specific customers. No count is given
- Precautions (November 12)
- Hosted: Legacy API off by default, Intune integration off. On-premises: confirm the Legacy API is disabled; N-able turned off the Intune integration (support contacts you if it could not)
- Indicators of compromise
- Published in the November 13, 13:40 UTC update, for customers who have not disabled the Legacy API (URLs, destination IP addresses and ports). Not reproduced in this article
- Further action
- A further hotfix is planned (November 11 blog). No date given
- Contact
- N-able Technical Support
What is known and what is not
Status as of November 14, 2026. We will update the status column when there is news.
| Item | What was said | Status |
|---|---|---|
| Fix for the first published set | HF2 (build 2026.4.1.26), seven CVEs | Confirmed (N-able) |
| Hosted update | All regions upgraded to HF2 | Confirmed (N-able) |
| Scanning tied to the test code | Observed | Confirmed (N-able) |
| Indicators of compromise | Published for customers who have not disabled the Legacy API; working with the specific customers | Confirmed (N-able) |
| November 12 advisory wording | As of that time, no signs of compromise from the new vulnerabilities | Confirmed (N-able; as of November 12; it updated on November 13 that it had identified indicators) |
| Number of compromised servers | Not stated. 21+ is Company A's report (press) | Not stated (N-able) / Reported (Company A) |
| Compromise of HF2 servers | 19 of the 21 were on HF2 (Company A's report) | Possible (press; no N-able confirmation found) |
| Nature of the exploitation | Installation of cryptocurrency mining software (Company A's report) | Possible (press) |
| Company B's observation | As of 10:25 AM ET on November 13, had not observed exploitation in its partners' environments | Not confirmed (Company B) |
| Legacy API setting | Company B wrote on November 13 that it confirmed the newer chain also requires the Legacy API to be enabled. The Legacy API setting of the compromised servers has not been reported | Not stated |
| Spread to customer endpoints | No report found | Not stated |
| Fix and CVE for the newer chain | A further hotfix is only announced. Press cites CVE-2026-90436, which we did not find on N-able's official pages | Under investigation |
How to read this: N-able's statement and Company A's report differ in timing and scope
N-able's November 12 advisory said that, as of that time, it had seen no signs of compromise from the new vulnerabilities, and on November 13 it updated that it had identified indicators and was working with the specific customers. The 21+ figure comes from Company A counting running mining programs, and we know it through press coverage. We could not find this count on N-able's official pages. Company B says it has not observed exploitation in its partners' environments. N-able's status page cannot be fetched automatically, so we read it in a browser to confirm.
What can happen when a management server is compromised
This is general information, not a statement that any of it happened here. What has been reported is the installation of cryptocurrency mining software.
Remote management software like N-central can run scripts and distribute software to managed endpoints. A general concern is that a hijacked server could be used for more than mining, such as pushing malicious software to customer endpoints or stealing administrator credentials. For an MSP, one compromise can reach several customers. A related case involving the same kind of tool is covered in ScreenConnect third-party extensions possibly abused.
What operators of remote management platforms should review
This section does not evaluate any organization's response or speculate on technical details. Based on the company's guidance, it narrows to what to check in your own setup, as our view.
Treat remote management software as a top-tier asset
A management server can reach every customer endpoint, so protect it more strictly than a production server. Put the console and API behind a VPN or a tightly restricted network, and disable features you do not use (here, the Legacy API) (our view).
Be able to apply fixes within hours to days of release
Here, another set of test code was published after the fix. Decide in advance the update order (Agents, Probes, server) and the interim defenses for when you cannot update (disabling features, restricting the network) (our view).
Restrict outbound traffic from the management server and keep logs
After a compromise, the management server pulls tools from outside. Limiting outbound connections to needed destinations and keeping logs for longer lets you check afterward against information like N-able's indicators (our view).
Monitor admin accounts and execution on managed endpoints
Set EDR or log alerts for unexpected admin account creation, new scripts, and unexpected commands launched by the management software. Company B gives similar advice.
Sources (public records)
The facts here come from the public information below. Attack steps and indicator details are not covered.
- N-able, "Status Dashboard" (N-central Critical Security Incident and other notices; updated 23:59 UTC on November 13, 2026; official status page, English; checked November 14) — uptime.n-able.com
- N-able, "N-central 2026.4 HF2 Release Notes" (official release notes, English; updated November 10; checked November 14) — status.n-able.com
- N-able, "Update on N-central 2026.4 HF2 and ongoing security response" (official blog, English; November 11, 2026; checked November 14) — n-able.com
- Company B's blog, "N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains" (English; updated November 13; checked November 14) — huntress.com
- BleepingComputer, "New N-able 4EverAble2Shell zero-day exploited hours after PoC released" (press, English; November 12; checked November 14; source of the 21-server report. We could not confirm Company A's original report) — bleepingcomputer.com
Update history
2026-11-14: First version. Based on N-able's official status page, release notes and blog, with the compromised-server count kept separate as Company A's report relayed by the press. We will update as news develops.
Read next
- A similar remote management tool incident: ScreenConnect third-party extensions possibly abused (November 2026)
- Protect your accounts: Multi-factor authentication guide
- Other 2026 incidents: 2026 data breaches and cyberattacks