N-able N-central unauthenticated XXE chains to RCE; public PoC, attempts seen

N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) on 2026-11-10 ^2,3. It fixes CVE-2026-125883 and six other CVEs, including an OGNL injection, an SSRF and a path-traversal RCE ². N-able's CNA record titles the flaw 'Multiple XXE Vulnerabilities' (CWE-611) and lists versions before 26.4.1 as affected ^1,2. The record scores it 9.3 under CVSS 4.0, with a network attack vector, no privileges and no user interaction ^1,2. The CVE appears to underpin a public chain in which an attacker with no credentials ends up running commands on the server as the nable user ². N-central is an RMM platform for MSPs and enterprise IT, so a compromised server puts the managed environments behind it at risk ³.

The flaws were published as zero-days ². Researcher Sean Bales released the Able2Shell repository with PoCs for 33 alleged issues ⁵. Its earliest commit is 2026-11-09 04:14 UTC, which is the evening of 2026-11-08 in US time zones ². The same day, N-able took hosted N-central offline and told on-premises customers to disconnect ^3,5. N-able said all hosted servers had been upgraded to HF2; Tenable dates that statement 2026-11-10 and Rapid7 dates the confirmation 2026-11-11 ^2,3. On-premises customers must apply the upgrade themselves ². N-able says the remaining reported issues need authentication or other conditions, and a follow-up hotfix will address them ⁵. It has not said which findings each of its seven CVEs covers, so linking this CVE to the published XXE chain is an inference ².

Scanning and exploitation attempts began on 2026-11-09 ^2,5. Previdian's decoy logged 68 events from one IP, including XXE and sensitive-file access attempts ². Previdian says none of them amounted to a completed takeover or a full chain replay ². Defused saw anonymous agent sessions, appliance configuration pulls and unauthenticated hits on the remote-control endpoint ⁵. Beazley Security Labs relayed watchTowr's report of honeypot attempts and said no confirmed customer compromise had been reported as of 2026-11-10 ². Huntress had seen no exploitation in partner environments as of that date ². N-able reports scanning tied to the PoC and no indications of compromise on hosted servers ⁵.

VulnDigest's VulnCheck signal lists the CVE as exploited from 2026-11-11 and references Previdian. The Previdian evidence behind it is decoy attempts, not a confirmed breach ². CISA KEV did not list the CVE as of 2026-11-12 ². On 2026-11-12, huntback reported XMRig miners on 21 live N-central servers, 19 of them reporting HF2 builds ². The miners were installed through the separate 4EverAble2Shell chain, which the researcher says needs the Legacy API ^2,6. That activity is not attributed to CVE-2026-125883, but it shows HF2 does not close every path to the server.

The CNA record classifies the issue as CWE-611, improper restriction of XML external entity references, and says it allows XML Schema Poisoning ¹. Its title, 'Multiple XXE Vulnerabilities', marks it as an umbrella ID for several issues rather than a single bug ^1,2. The researcher's unauthenticated XXE chain abuses N-central's service-import functionality ².

In the researcher's PoC, the XXE makes the appliance fetch content from an attacker-hosted server ². Rapid7 says the chain combines XXE with session-handling weaknesses ³. The chain ends in command execution as the nable service account (uid 992), not root ². The same PoC can create an administrator account ²; BleepingComputer reports it is a Default Administrator account with credentials the attacker sets, giving admin access to the management interface ⁴.

The attacker needs network access to the server and no credentials ^1,2. The PoC takes several identifiers as input, and other findings in the researcher's README describe anonymous ways to obtain some of them ². The Legacy API requirement applies to the later 4EverAble2Shell chain, not to the original XXE chain ².

1. 1

   Upgrade on-premises N-central to 2026.4 Hotfix 2 (build 2026.4.1.26) as soon as possible, as N-able recommends ^4,5.

2. 2

   Keep on-premises servers offline until the upgrade has completed ².

3. 3

   Upgrade Agents first, then Probes, because an upgraded Probe cannot talk to non-upgraded Agents ². HF2 removes legacy MDM and temporarily disables built-in remote control. Take Control still works ².

4. 4

   Confirm the Legacy API is off, which is its default, as N-able told on-prem customers on 2026-11-12 ². N-able also disabled the Intune integration for hosted customers and temporarily deactivated it for on-prem customers ².

5. 5

   Treat servers that were exposed and unpatched from 2026-11-09 onward as possibly compromised. Preserve logs first ⁷. Remove administrator accounts you did not create. As a precaution, rotate N-central account passwords and any credentials stored on the server.

6. 6

   If you suspect compromise, treat it as a potential compromise of every managed environment behind the server, and engage incident response ³.

7. 7

   Track N-able's follow-up hotfix for the remaining issues ^3,5. Also track its response to the 4EverAble2Shell and Agent2Shell claims against HF2 ^2,6.

• Inventory every N-central server and confirm it runs build 2026.4.1.26 or later. Anything before 26.4.1 is affected ^1,2.
• Preserve logs before changing or rebuilding the server. Review authentication and administration activity since at least the start of November ⁷.
• Huntress advises reviewing N-central login and authentication activity from 2026-11-08 onward and watching for anomalous remote access and unauthorized new administrator accounts ².
• Look for administrator accounts you did not create, including a Default Administrator account with credentials your team did not set. Creating such an account is an outcome of the published chain ^2,4.
• Check egress logs for the N-central server fetching content from unfamiliar external hosts, which is what the XXE step causes ². On the server, look for unexpected shells or commands under the nable account (uid 992) ².
• Search access logs for anonymous agent sessions, appliance configuration pulls and unauthenticated requests to the remote-control endpoint. Defused reported these probing patterns, but they are not a formal IOC list ⁵.
• On HF2 servers, check for XMRig or other miner processes and confirm whether the Legacy API is enabled. Both relate to the separate 4EverAble2Shell chain ².
• Beazley Security Labs and Previdian have published source IPs and targeted SOAP endpoints ². This brief does not reproduce them, so obtain them directly from those publishers.

1. Nov 9, 2026

   Researcher publishes Able2Shell PoCs for 33 alleged N-central issues. The first commit is 04:14 UTC, the evening of 11-08 in US time zones. ²

2. Nov 9, 2026

   N-able takes hosted N-central offline and tells on-premises customers to disconnect. ⁵

3. Nov 9, 2026

   Scanning begins. Defused sees anonymous agent sessions, config pulls and unauthenticated remote-control requests. ⁵

4. Nov 9, 2026

   Previdian's N-central decoy starts logging events from one IP, including XXE attempts; no completed takeover. ²

5. Nov 10, 2026

   N-able releases N-central 2026.4 HF2 (build 2026.4.1.26) and publishes seven CVEs, including CVE-2026-125883. ²

6. Nov 10, 2026

   Beazley Security Labs adds watchTowr's report of honeypot exploitation attempts and notes no confirmed customer compromise. ²

7. Nov 11, 2026

   Rapid7 reports N-able's confirmation that all hosted N-central servers are upgraded to HF2. ³

8. Nov 11, 2026

   VulnCheck KEV lists the CVE as exploited, citing Previdian (VulnDigest live signal).

9. Nov 12, 2026

   Researcher publishes 4EverAble2Shell and Agent2Shell, claimed to work against HF2. N-able says it is investigating. ⁶

10. Nov 12, 2026

    huntback reports XMRig miners on 21 live servers (19 reporting HF2) via 4EverAble2Shell, not this CVE. ²

11. Nov 12, 2026

    N-able tells on-prem customers to keep the Legacy API off and disables or deactivates the Intune integration. ²

12. Nov 13, 2026

    Brief updated: citations corrected, hosted-upgrade date sourcing clarified, Intune and rogue-admin details added.

1. 1
   CVE Record: CVE-2026-125883

   CVE Program / N-able (CNA) · Database · Nov 10, 2026
2. 2
   Able2Shell: Frequently asked questions for reported N-able N-central zero-day vulnerabilities

   Tenable · Research · Nov 12, 2026
3. 3
   Critical vulnerabilities in N-able N-central prompt hosted shutdown

   Rapid7 · Research · Nov 10, 2026
4. 4
   N-able releases security hotfixes for zero-day vulnerabilities

   BleepingComputer · News · Nov 12, 2026
5. 5
   Hackers Target N-central Zero-Days as N-able Rushes Patches

   SecurityWeek · News · Nov 12, 2026
6. 6
   New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access

   The Hacker News · News · Nov 12, 2026
7. 7
   N-able Takes N-central Platform Offline After Discovery of 33 Flaws

   Dark Reading · News