N-able Patches N-central After Taking Hosted Servers Offline
N-able has released N-central 2026.4 Hotfix 2, build 2026.4.1.26, to address critical security issues in its remote monitoring and management platform. The company took hosted servers offline on 9 November after exploit code became public. The update tightens server access checks, removes legacy mobile device management and changes how Agents and Probes communicate. N-able Hotfix 2 release notes · N-able’s incident chronology
Check who owns each part of the rollout
N-able upgrades the hosted N-central servers. Self-hosted customers must upgrade their own servers. Both groups need to update Agents and Probes. N-able advises upgrading Agents first. An updated Probe cannot use the new communication path until the Agent and Patch Management Engine are also compatible. The offline patch cache can be unavailable in the interim. Check communication and patch-cache behaviour before closing the change. N-able compatibility and upgrade notes
The release notes say built-in remote control is temporarily unavailable. N-able says Take Control continues to work. Check which remote support route your team actually uses before planning maintenance. N-able known issues
Update, 11 November 2026
N-able urged on-premises customers to keep their servers off the internet until the hotfix was installed. The company reported scanning tied to public proof-of-concept code and said it had found no indication of compromise on its hosted servers at that point. That observation covers N-able’s hosted environment. A self-hosted operator needs to assess its own exposure and logs. N-able said a follow-up hotfix was in development. N-able’s response update
Update, 12 November 2026
New exploit code targets Hotfix 2 servers with the Legacy API enabled. Huntback says it captured the full server exploit against a decoy and identified likely compromises by matching cryptocurrency miner activity with reachable N-central servers, including systems running Hotfix 2. N-able advises on-premises customers to confirm that Legacy API access is disabled and to continue the Agent and Probe rollout. If the API was exposed, investigate the server and the endpoints it manages. N-able said it applied temporary protections directly to hosted environments. N-able’s updated guidance · Huntback’s observations
Update, 13 November 2026
N-able identified additional indicators of compromise and said it was working with affected customers. Huntress reports that N-able also confirmed that Agent2Shell, like 4EverAble2Shell, requires the Legacy API to be enabled. Agent2Shell can reach managed Windows endpoints, so an investigation should cover both the N-central server and the devices it manages. Huntress’s 13 November update
If the Legacy API was exposed, keep it disabled, preserve server and endpoint logs, and compare outbound connections with the published indicators. Huntback documented an attempted installation of the XMRig miner against a decoy and linked mining activity to reachable N-central servers. A server’s installed build can establish its patch level, but investigating activity during the exposure window is how operators can look for compromise. Huntress’s indicators · Huntback’s analysis
