2026-11-14
N-able N-central Vulnerability Reportedly Exploited Right After Public Test Code Release (November 2026): 21+ Servers Reported Compromised, N-able Points to the HF2 Fix and Disabling the Legacy API. What Administrators Should Do
N-able took its hosted N-central offline on November 9, 2026, after an independent researcher published many vulnerabilities and test code on November 9, according to N-able's blog (nicknamed Able2Shell), and released the fix N-central 2026.4 HF2 (build 2026.4.1.26) on November 10. Its status page says it observed scanning tied to the published test code. In a November 12 advisory it asked customers to confirm the Legacy API is disabled and paused the Intune integration. On November 13 (UTC) it published indicators of compromise for customers who have not disabled the Legacy API and said it is working with the specific customers where it found them. N-able's official pages give no count of compromised servers. According to press reports, a security company (Company A) says at least 21 production N-central servers (19 of them on HF2) were compromised after a second set of test code was published (press reports differ: the night of November 11 or on November 12), and that cryptocurrency mining software was installed. A fix for this newer chain had not been published as far as we could confirm, and N-able says a further hotfix is coming. N-able's November 12 statement that it had seen no signs of compromise concerned the new vulnerabilities, as of that time. Our view: do not stop at checking the version. Confirm the Legacy API is off, limit exposure of the console, and check for compromise today.