--- title: "N-able ships its N-central fix as exposed servers fall from 1,338 to about 148" summary: "N-able’s release notes, status page and CVE records of 10 and 11 November: what Hotfix 2 fixes, what it switches off, and what a managed service provider does next." url: https://www.thetechbag.com/blog/n-able-hotfix-exposed-servers-1338-to-148 format: Note desk: "Security" area: "Endpoints & devices" region: Global published: 2026-11-11 facts_checked: 2026-11-11 author: TechBag (The TechBag Journal) tags: ["N-central vulnerability","N-able hotfix","N-central exploits","N-central patch","N-able","N-central","RMM","hotfix","Able2Shell","managed service providers","CVE-2026-125883","XXE","OGNL injection","Shadowserver","Take Control","remote control"] cover: https://www.thetechbag.com/blog/covers/n-able-hotfix-exposed-servers-1338-to-148.png --- # N-able ships its N-central fix as exposed servers fall from 1,338 to about 148 *N-able’s release notes, status page and CVE records of 10 and 11 November: what Hotfix 2 fixes, what it switches off, and what a managed service provider does next.* Note · Security · Endpoints & devices · By TechBag · Published 2026-11-11 · Facts checked 2026-11-11 · Canonical: https://www.thetechbag.com/blog/n-able-hotfix-exposed-servers-1338-to-148 N-able released N-central 2026.4 Hotfix 2 late on 10 November, about 41 hours after a researcher published 33 exploits for its remote-management software, and by 01:04 UTC on 11 November it had upgraded every hosted server in all regions.[1][2] On-premises servers are the customers’ job. Shadowserver, a non-profit that scans the internet, counted 1,338 N-central servers reachable online on Monday 9 November and just over 148 on 11 November, BleepingComputer reported.[4] 1,338 N-central servers reachable online on 9 November Shadowserver, via BleepingComputer ~148 reachable on 11 November Shadowserver, via BleepingComputer 7 CVEs fixed in Hotfix 2; two are entries for several bugs N-able release notes 2 of the seven rated critical, both reachable without a login CVE records, CVSS 4.0 ## What the fix covers, and what it leaves for later The hotfix, build 2026.4.1.26, lists seven CVEs. Two are labelled as several flaws at once: “Multiple XXE Vulnerabilities”, the XML class behind the researcher’s most serious chain, and “Multiple OGNL Injection vulnerabilities”.[1] The XXE entry and a server-side request forgery in service import both score 9.3 and need no login; the rest need a login, an administrator’s rights or local access, and score 8.3 to 8.7.[3] N-able calls it the release “addressing the most critical November 9 vulnerabilities” and says “a follow-up hotfix will be released to provide further security updates”.[2] The release also removes legacy mobile device management and switches off N-central’s built-in remote control, which “will be re-enabled in a future fix”; Take Control, N-able’s separate remote-access tool, keeps working.[1] Defused, a threat-intelligence company, said on 10 November it had seen probes opening anonymous agent sessions, pulling appliance configuration and “hitting the remote control endpoint without auth”.[4] N-able reports scanning tied to the published code; neither it nor CISA’s list of exploited flaws records an attack on a customer.[2][6] **Figure: Hosted servers were upgraded about 45 hours after the exploits went public** *N-central events, 9 to 11 November 2026, in UTC* | Date | Event | Detail | | --- | --- | --- | | 9 Nov, 04:14 UTC | 33 exploits published | Able2Shell repository on GitHub | | 9 Nov, 14:00 UTC | Hosted N-central offline | On-premises customers told to switch servers off | | 10 Nov, 20:48 UTC | Hotfix 2 release notes | Build 2026.4.1.26 | | 10 Nov, 21:19 UTC | Seven CVEs published | 21:19 to 21:26 UTC | | 11 Nov, 01:04 UTC | All hosted servers upgraded | | | 11 Nov, 12:32 UTC | About 148 servers reachable | Shadowserver, as reported | Source: Researcher's repository; N-able release notes and status page; CVE records; BleepingComputer · as of 11 November 2026 · The last event is the time BleepingComputer published the count ## What a managed service provider should do now Upgrade the server before bringing it back online: N-able still advises keeping on-premises servers off “until your server has been successfully upgraded”. Versions from 2025.4 upgrade directly; anything older must first move to a supported build.[1][2] Then upgrade agents and probes, which both hosted and on-premises customers must do themselves, agents first: a probe on the new build cannot talk to an older agent, and features such as the offline patch cache stop until both match.[1] Plan for remote sessions to run through Take Control until built-in remote control returns. Our viewA patch closes the hole, not the visit After the August zero-day, N-able warned that a hotfix “does not remove a threat actor who may already be present”.[5] Any server that was reachable between 9 November and its upgrade deserves a check for administrator accounts nobody created. The background, including why one console reaches every customer, is in our Note of 10 November, [N-able takes N-central offline worldwide after 33 exploits go public](https://www.thetechbag.com/blog/n-able-n-central-offline-33-exploits). How we did this Figures as of 11 November 2026, 8pm IST Release notes, status page and CVE records are N-able’s own; the scores are CVSS 4.0 as N-able assigned them. The 41 and 45 hours are our arithmetic from the repository’s first commit to the release notes and the status update. Shadowserver’s 1,338 and about 148 are as BleepingComputer reported them: the dashboard could not be read directly, and the count is of servers reachable from the internet, not of servers unpatched, so it does not say how many of the 148 run the fix. Defused’s observations are its own. CISA’s catalogue was checked as released on 10 November. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [N-able, N-central 2026.4 HF2 Release Notes (build 2026.4.1.26)](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/) — 10 November 2026 2. [N-able, status page: N-central Critical Security Incident, Release Available (event 202584)](https://uptime.n-able.com/event/202584/) — update of 11 November 2026, 01:04 UTC 3. [CVE Program, records CVE-2026-125878 to CVE-2026-125883 and CVE-2026-91000 (N-able as CNA)](https://www.cve.org/CVERecord?id=CVE-2026-125883) — 10 November 2026 4. [BleepingComputer, N-able releases security hotfixes for zero-day vulnerabilities](https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/) — 11 November 2026 5. [N-able, N-central Security Update (first published 6 August, updated 10 August)](https://www.n-able.com/blog/n-central-security-update-august-10-2026) — 10 August 2026 6. [CISA, Known Exploited Vulnerabilities catalogue (N-able entries)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) — as released 10 November 2026 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. **Read this next:** [Exploited flaws now get 3 days, not 21: CISA rewrote the patch clock](https://www.thetechbag.com/blog/cisa-exploited-flaw-deadline-21-days-to-3) — If these flaws reach CISA’s list: exploited flaws now get 3 days, not 21, after the 10 June directive that ended the 21-day clock. Go deeper on TechBag - [N-able takes N-central offline worldwide after 33 exploits go public](https://www.thetechbag.com/blog/n-able-n-central-offline-33-exploits) — the disclosure, the shutdown and why one console reaches every customer - [RMM and patch management guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — the products that manage fleets from one console, compared - [N-able intel hub](https://www.thetechbag.com/n-able) — N-central, N-sight and the rest of the portfolio