N-able N-central: a researcher published proof-of-concept code for 33 alleged unpatched flaws, among them an unauthenticated XML external entity chain to remote code execution, and N-able took hosted N-central offline and told on-premises customers to power servers down; no CVE ids yet

An independent researcher published the details of what Huntress counts as 33 critical flaws in the N-central appliance, which chain into four exploits, three leading to remote code execution and one to privilege escalation to root (Huntress, 2026-11-09); Field Effect says the material includes technical write-ups, screenshots and Python proof-of-concept code (Field Effect, 2026-11-09). The researcher tested pre-release build 2026.4.0.31, and BleepingComputer reports he believes most or all of the flaws also affect earlier versions (BleepingComputer, 2026-11-09). One of the chains BleepingComputer calls most critical abuses an unauthenticated XML external entity flaw in the service-import function to steal a trusted local session, reset an account password and run commands as the service user (BleepingComputer, 2026-11-09); Field Effect reads the material as a mix of authenticated and unauthenticated flaws whose claimed impacts include administrator-account creation, credential disclosure, configuration changes and audit-record manipulation (Field Effect, 2026-11-09). No source has validated the individual claims (Censys, 2026-11-09), but N-able took its hosted environments offline on 2026-11-09 and told customers who run N-central themselves to keep their servers offline until it confirms they are safe (Huntress, 2026-11-09; BleepingComputer, 2026-11-09).

N-able said it had seen no active exploitation as of 2026-11-09 15:15 UTC and is building a hotfix (Huntress, 2026-11-09). It had published no mechanism detail, affected versions or fixed versions, and no CVE identifiers or scores existed (Censys, 2026-11-09); Huntress notes that N-able does not always change the version number when it ships a no-reboot hotfix, so the fixed build may be numbered like the vulnerable one (Huntress, 2026-11-09). Censys counts 1,728 N-central web consoles on the internet (Censys, 2026-11-09). The same product had earlier flaw waves in 2026, among them the pre-authentication CVE-2026-86218, which Field Effect says was added to CISA's Known Exploited Vulnerabilities catalog (Field Effect, 2026-11-09); the disclosed flaws are separate ones.