N-able releases N-central 2026.4 Hotfix 2, a critical security update

N-able has released N-central 2026.4 Hotfix 2, build 2026.4.1.26, and says customers should keep servers offline until that upgrade is finished. The company's incident page lists the status as Monitoring, and it has no end time.

The hotfix is the patch for the November 9 flaws. N-able says the release covers the most serious vulnerabilities disclosed on November 9. Hosted regions are being upgraded now, including trial systems, and access comes back as each region finishes checks. On-premises customers are told to upgrade as soon as they can, and to follow the published steps before they turn normal access back on. Earlier guidance had told those customers to keep servers offline while a fix was still being built.

Agents and Probes have to move too. The November 10 release notes say N-able upgrades hosted servers, while every customer, hosted or on-premises, must update Agents and Probes. The notes say to update Agents first, then Probes, so the two can still talk to each other. They also say built-in remote control is off for now and will return in a later fix. Take Control still works.

A proof-of-concept is public. A break-in is not confirmed. N-able says an independent researcher disclosed the flaws, and that proof-of-concept code is public. It says it is seeing scanning tied to that code. It has not reported a confirmed successful intrusion of a customer environment. Scanning is not the same as a confirmed break-in.

Another hotfix is still planned. N-able says a follow-up hotfix will carry more security updates as the response continues. The release notes list seven fixed identifiers: CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, and CVE-2026-91000.