"Publishing exploit code before customers have had the chance to act doesn't make anyone safer. It hands attackers a head start," N-able president and CEO John Pagliuca told Infosecurity, framing the dispute that followed the public release of 33 alleged zero-days for the company's N-central product.
N-able issues N-central 2026.4 Hotfix 2 (build 2026.4.1.26)
On November 10, N-able published release notes for N-central 2026.4 Hotfix 2, build 2026.4.1.26, describing the update as a "critical security release" for its remote monitoring and management (RMM) platform. The hotfix temporarily disables the product's built-in remote control and instructs customers to update agents and probes after upgrading. N-able said the release addresses "the most critical November 9 vulnerabilities" and that a follow-up hotfix will bring further security updates. The company also told Infosecurity that hosted N-central environments have been upgraded and are back online.
Prior to the hotfix, N-able took hosted N-central offline on November 9 as a precaution and told on-premises customers to keep their servers offline until they could be updated. The remote-control capability disabled by Hotfix 2 will be re-enabled in a future fix, according to the release notes.
Able2Shell disclosure: Sean Bales published 33 alleged zero-days
The Able2Shell disclosure, published November 9 by researcher Sean Bales, presented 33 alleged zero-day vulnerabilities with proof-of-concept (PoC) code. Bales described four exploit chains that he said ended in code execution on an N-central server: two chains he said achieved root privileges and one he called credential-free. He told readers he had tested the flaws on a pre-release build and believed most, if not all, would work on earlier versions including the then-current release.
Bales argued that "publishing makes vendors safer by forcing them to fix problems as fast as possible." N-able disputed that account of prior contact: the company said the vulnerabilities published on November 9 had not been disclosed through its established reporting channels. Bales confirmed N-able's description was accurate, saying he had not disclosed the vulnerabilities to the company and that an outdated README — which he has since changed — likely caused some confusion about responsible disclosure.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHotfix covers seven CVEs; mapping to the 33 published issues remains unspecified
Hotfix 2 explicitly addresses seven Common Vulnerabilities and Exposures entries: CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 and CVE-2026-91000. The release notes describe the vulnerabilities addressed as covering XML external entity (XXE) flaws, Object-Graph Navigation Language (OGNL) injection, privilege escalation, stored cross-site scripting (XSS), server-side request forgery (SSRF) and remote code execution through path traversal. CVE-2026-125882 credits Nate Fair of Sprocket Security.
Neither N-able's release notes nor the company's statement map those seven CVE identifiers to the 33 issues published in the Able2Shell disclosure. Proof-of-concept code for all 33 alleged zero-days remains public.
Exploitation attempts observed; monitoring firms report activity
N-able said it was seeing scanning activity linked to the published PoC code. Beazley Security, the cybersecurity arm of insurer Beazley, updated an advisory on November 10 reporting that security firm WatchTowr observed exploitation attempts against its N-central honeypots overnight after the disclosure. Beazley noted the targeted systems were decoys and not customer environments. The rapid appearance of scans and attempted exploitation underscores the immediate operational impact of publicly released PoC code.
What this means for technologists, managed-service providers, and insurers/monitors
- Technologists and security teams: Patch management remains the immediate task. N-able's release notes instruct customers to upgrade to Hotfix 2 and then update agents and probes; remote control is disabled until a future fix, which changes the risk and operational profile for incident response and remote troubleshooting.
- Managed service providers and on-premises customers: N-able advised on-premises servers to remain offline until patched; hosted environments were taken offline and later brought back online by N-able. Providers who rely on N-central's remote-control capability will need to plan for its temporary absence and for subsequent re-enablement when N-able issues further updates.
- Insurers and security monitors (Beazley, WatchTowr): Monitoring and deception assets detected scanning and exploitation attempts tied to the public PoC. Those observations informed public advisories and provide early indicators of attacker activity after the Able2Shell disclosure.
The tradeoff at the center of this incident is explicit in the parties' statements: the researcher, Sean Bales, says publication forces faster fixes; the vendor, John Pagliuca at N-able, says publication hands attackers a head start. For now, N-able has pushed a targeted response — a hotfix that addresses seven CVEs, temporarily removes remote control, and promises more fixes to come — while proof-of-concept code for 33 alleged flaws remains in the wild and exploitation attempts have already been observed. How quickly the remaining issues are tied to CVEs and mitigated, and when remote control will be safely restored, are concrete next steps named by N-able's own release notes and statements.
Source: Infosecurity — N-able Rushes Out N-central Fixes After 33 Zero-Days Go Public
