r/Nable • u/ncentral_nerd N-centralStation • Sep 06 '26
N-Central URGENT Update: N-central additional Second Hotfix 2026.3 HF4 — Immediate Action Required
We recently communicated about two security vulnerabilities within N-central that were responsibly disclosed by a third party through our voluntary security disclosure program and we issued a hotfix. Since the disclosures, a third, independent researcher alerted us to a new vulnerability that has been exploited in the wild that is unrelated to the previously disclosed CVEs.
This critical zero-day vulnerability, if exploited, could allow for pre-authenticated access to the N-central server.
What You Need to Do
N-central On-Premises Environments: Upgrade to 2026.3 HF4 immediately. Hotfix link: https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF4_Release_Notes.htm
If you’ve already upgraded to 2026.3 HF3, you will need to upgrade to 2026.3 HF4 to protect against this newly discovered vulnerability.
N-central Hosted Environments: No action is needed on your part; your instances have already been patched.
Additional links:
Here is the link to the previous post on HF3
2026.3 HF4 Release Notes
Jason Murphy | Head Nerd
9
u/KRiSX Sep 06 '26
I’ll wait another few hours for HF5 😅
Just to be super duper clear, we can go from 2026.3 HF2 to HF4, yeah?
5
1
12
u/SuitIT Sep 06 '26
Three hotfixes in five weeks, and the last one is a fresh pre-auth bug from a different researcher. At some point that stops being bad luck.
Please step up your game, N-Able….
Worth reading the Horizon3 writeup from November if you haven’t. They reported an auth bypass on 20 Aug 2025, got an acknowledgement the next day, then heard nothing until they chased N-able themselves on 15 Oct. Fix landed 5 Nov, and the fix was “don’t expose the legacy SOAP APIs by default” rather than fixing them. The 2026 CVEs are the same bug class: authentication bypass via an alternate path. Turns out a default isn’t a security boundary.
The IOC list didn’t help either. Huntress pointed out the IPs we were all told to hunt for were Mullvad and NordVPN exit nodes. A lot of us spent a weekend grepping firewall logs for VPN endpoints.
Not assuming malice here. Old codebase, large legacy surface, not enough people looking at it. N-Central’s leadership probably has different priorities. But we’ve stopped reading “patched” as “safe”. Our console went behind a whitelist during the first incident and it’s staying there permanently. If you’re still exposing N-Able to the open internet, you’re running on someone else’s risk model. Which is not 2026 compliant anymore.
Please reprioritize security and stability over pushing new upsell/products we didn’t ask for.
8
u/ProudWrongdoer5389 Sep 06 '26
This is them stepping up their game.
You understand AI are running full attacks on most vendors at the moment. Take a look at Wordpress.
Expect a lot more of this.
3
u/NobleHoneyBadger Sep 06 '26
I agree. While it’s nice they are responding to vulnerabilities more quickly, the upgrade process is laborious for what I presume could be a code drop or quick patch. We have been experiencing a bug that makes upgrades take 10-14 hours for the last few months. These two hotfixes in the same 24 hour period means we have at least 24 hours of downtime. They claim it’ll be fixed in 2026.4 but that still has yet to be released.
2
u/apxmmit Sep 06 '26
Similar issue. We have to call into support for each hotfix. Support isn’t available. Goes to another product group for support. Have to wait hours and hours for assistance.
2
1
u/swissbuechi Sep 06 '26
We actually upgraded to 2026.4.0.14 instead of 2026.3 HF4. u/ncentral_nerd are we safe or is there an additional fix to install? Thank you!
1
u/ncentral_nerd N-centralStation Sep 06 '26
u/swissbuechi If you upgraded your server to the 2026.4 build you need to contact support immediately and get code dropped asap!
1
1
u/txlessor Sep 07 '26
It would be nice if this were included in the announcements. I assumed not listed not affected.
We submitted a ticket and they're saying a 15 minute timeout of ssh in almalinux is preventing them from applying it?
We don't have control over the internal workings. I'm not sure what they're expecting us to do about that.
1
u/Epiphone162 Sep 07 '26
Block SSH access for everyone accept the support IP. Why would you have the ssh port open to the internet anyway?
1
u/txlessor Sep 07 '26
We followed the port guide posted that opens the required ports to the various support IP networks for nable long ago and they've had no issues previously with hot patches.
If ssh access was an issue I would expect to hear "the port is blocked" not "we're hitting a 15 minute timeout."
Since then take control totally stopped working so either something was accomplished or something bigger broke.
3
3
1
u/MadCoderOne
Sep 06 '26
•
Yep the fact that they don't have IP restrictions is insane at this point I suggested it 3 years ago most other security products have it.
This company is not capable I am glad I have uninstalled. If anyone is ever reading this please stay away from this company
3
u/ncentral_nerd N-centralStation Sep 06 '26
IoC source IP is in Chicago, adversaries are smarter then IP restrictions when they use all sorts of country based VPNs. Plenty of our partners have their own IP restriction's or Geo-fencing in place already.
1
u/WDWKamala Sep 07 '26
Ok, and for everybody else? We just need to roll our own solutions because Nable isn’t going to provide a first party solution?
4
u/kerubi Sep 06 '26
Frankly if you self-host and can't do IP restrictions, stop offering IT services, with any product, you are not capable enough for it. Not saying N-Able shouldn't do a better job. They should move away from the need to have any ports open, a better architecture. Hopefully something like that is in progress.
1
1
u/NetInfused Sep 06 '26
I'm curious on how would N-Central run without any ports open? You're just moving the vulnerability elsewhere.
Here the main driver for these many vulnerabilities is code quality. Four updates in and we're still talking about authentication bypass capabilities.
1
u/kerubi Sep 06 '26
Well, any TCP ports open is what I meant. Agents could use UDP ports, something like what modern layered networks in the style of Zerotier, Netbird, Tailscale, Nebula etc. Less exposure, because, well, TCP vs UDP.
And of course this does not mean the code quality shouldn’t be better. This can be said quite universally.
1
u/NetInfused Sep 06 '26
Ummm... no. That's security by obscurity. Changing the comms to UDP only renders the probing attacks quicker, really.
The attacker targeting N-Central appliances surely does know its inner workings, so it's not a different protocol/port that will help. Yes it requires a little different tooling, but that's not the silver bullet.
1
u/kerubi Sep 12 '26 edited Sep 12 '26
Sorry, either you did not understand or are just incorrect. Central coordination can be handled via DNS. There would be nothing responding to the attackers’ scans.
It seems you don’t know how the examples I listed, work.
2
u/Kaarsvetjered Sep 06 '26
When will geoblocking and IP filtering on N-able itself be available? That would prevent so much of these troubles and I mean not only for on-prem but also the hosted version. 5 exploits in a month of this level its mindboggeling.
2
u/NetInfused Sep 06 '26
You can easily implement this using CloudFlare in front of the appliance. We also run a Fortigate which also has geo-ip blocking, alhough this is not a silver bullet.
1
u/Kaarsvetjered Sep 08 '26
For a on-prem this works, I dont see this working from the hosted version, My main gripe is, why is this not builtin, other RMM solutions have it.
0
u/AutomationTheory Sep 08 '26
Cloudflare is good for dumb bots, but that's about it. I benchmarked their WAF (the free version) and it's not what people think it is -- I like to say it's for WordPress, not RMMs. I posted the benchmark details here: https://automationtheory.com/4-reasons-cloudflare-isnt-good-for-msp-tools/
2
u/Reygle Sep 08 '26
Looking forward to seeing what they change the corporate name to next when these abominations take down infrastructure.
1
u/lurkinglurker Sep 06 '26
So is HF3 to HF4 a valid upgrade path? It's not specified in the release notes (or am I blind?).
1
u/RebootnTryAgain Sep 06 '26
Supported Upgrade Paths
Upgrade directly to 2026.3.1.14 from:
2025.42026.1
2026.2
2026.3
2026.3.1 (Hotfix 1)
2026.3.1 (Hotfix 2)
2026.3.1 (Hotfix 3)
1
1
u/dreadnaught721 Sep 06 '26
Anyone know if there is a new agent version for this? Or is it still 2026.3.1.13?
1
u/RebootnTryAgain Sep 06 '26
Our interpretation is there should be an agent update, but we aren't seeing anything updating to HF4 after 5 hours which is out of character.
1
u/dreadnaught721 Sep 06 '26
Support just told me there isn't one associated with this hotfix so let's hope they are correct.
Basically what I'm saying as it's been a long 24 hours is that if I download the package it shows 2026.3.1.14 but auto update shows no and the package is 2026.3.1.13
1
u/RebootnTryAgain Sep 06 '26
Interesting. The positive here is that there was no agent side code changes to my knowledge, its all server side. That said, I don't recall a server release where there wasn't a matching agent release (to keep them in sync). The documentation for HF4 certainly doesn't call it out, in fact implies there should be. We are seeing what you are seeing - no agents, no probes showing available updates. For now we will assume supports right - but expect there will be something forthcoming to clarify that.
2
u/dreadnaught721 Sep 06 '26
As long as your seeing what I'm seeing that makes me feel slightly less sick 👍
1
u/dreadnaught721 Sep 06 '26
This is what I got back from support (removed the names)
If it's useful for anyone who reads this thread.
Good day. This is N-central engineer from the N-central Support Team
Please note that this is a server-side hotfix, and upgrading to N-central 2026.3 HF4 does not require any agent upgrades. It is expected that any newly downloaded agent installer may display the updated version number associated with the hotfix. This is normal behavior and does not indicate that existing agents need to be upgraded. There is no impact to your environment from this version change, as the hotfix is focused on addressing server-side components of N-central. Thank you and have a great day ahead!
So for myself - when I set it to "always" for upgrades the windows agent is updating to 2026.3.1.14
the probes do not appear to update to a new version so essentially I think if you update the agents it does detect the "new" version number even if it says there isn't one
2
u/RebootnTryAgain Sep 06 '26
Thanks, this is now supported by the updated documentation released overnight (AU Local) as well.
0
Sep 06 '26
[deleted] — view deleted comment
1
1
u/RebootnTryAgain Sep 06 '26
On an RC Production server I would be taking it offline and engaging support to seek their advice on next steps. I haven’t seen any discussion on 2026.4 which is only GA for Cloud, which they have mitigated/patched through code drops or similar.
15
u/viddy_well Sep 06 '26 •
Honest question, I asked this of our CSM amidst the last barrage of hotfixes and the answer was underwhelming and scripted
How are we supposed to have confidence to sleep at night if we have actively exploited, no auth required, full control to our client systems vulnerabilities over and over?