Your IT provider’s remote-control tool just had 33 flaws published online

If an outside IT provider looks after your computers, there’s a fair chance it manages them through a single remote-control platform. One of those platforms has just had a very bad week.

A security researcher published details of 33 flaws in N-able’s N-central on GitHub, with no fix available. N-central is a remote monitoring and management tool built for IT providers and IT teams. It lets them patch, script and take control of every computer they look after. Attackers who break in can use that reach to push scripts and tools to clients, as happened after a September flaw.

N-able has now released a fix. Your IT provider may still have work to do.

Thirty-three flaws, posted without warning

The researcher’s write-up, titled “Able2Shell”, describes flaws that can be chained together to take over an N-central server. Security firm Huntress counted four attack chains: three let an attacker run their own commands on the server, and one gives them root (full administrator) access.

Several of the flaws work without logging in. The researcher tested a pre-release build, 2026.4.0.31, and says most if not all of the flaws should also work on earlier versions. At the time of posting, they were unpatched.

N-able pulled the plug

On 9 November, N-able took its hosted N-central servers offline, Huntress reports. It told customers running N-central on their own servers to keep them offline until it said it was safe.

The next day N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26, which it calls a critical security update. It fixes seven newly numbered vulnerabilities, tightens sign-in and permission checks, and removes N-central’s old mobile device management feature.

Huntress says N-able has upgraded all hosted servers and brought them back online. N-able also told customers it had seen scanning linked to the published attack code, but no evidence that any customer had been successfully hacked.

The fix isn’t finished until the agents are done

Hosted customers don’t need to touch their server. Everyone else does. Here’s what N-able’s release notes ask for:

• Your own server: if you run N-central on premises, upgrade it as soon as possible. Builds from 2025.4 onwards can go straight to the hotfix. Anything older must first be upgraded to a supported version.
• Agents and Probes: every customer, hosted or not, must upgrade these. Agents are the small programs on each managed computer, and Probes collect information on each client network. Upgrade Agents first, then Probes.
• Order matters: a Probe upgraded before its Agents stops talking to them. Features such as the offline patch cache then stop working until the Agents catch up.

One more change: N-central’s built-in remote control is switched off for now. N-able says it will come back in a future fix, and its separate Take Control tool still works.

Not N-central’s first emergency this year

Huntress lists five other critical flaws in August and September, one of which attackers exploited before it was fixed. Western Australia’s government cyber security unit issued an advisory about the exploited September flaw, rated 10 out of 10 for severity.

After that flaw, attackers pushed unwanted scripts and tools into clients’ networks, Huntress says. So check more than the server: review sign-ins from 8 November onwards, and look for unexpected remote sessions, new scripts and new administrator accounts.

If you’re a business owner, you don’t need to know any of this in detail. Ask your IT provider one question. Do they use N-central, and are the server and every agent on your computers on build 2026.4.1.26 or later? For broader steps to harden your own systems, our Essential Eight guide is a good place to start.

Checklist

• Ask your IT provider if they use N-able N-central. If they do, ask whether their server and the agents on your computers are on build 2026.4.1.26 or later.
• Upgrade your own N-central server. If you run N-central on premises, install 2026.4 Hotfix 2 (build 2026.4.1.26) before bringing the server back online.
• Upgrade every Agent first, then every Probe. Do this on hosted and on-premises sites alike, or Agents lose contact with upgraded Probes.
• Review N-central sign-ins from 8 November. Look for logins you don’t recognise, new administrator accounts and remote sessions nobody booked.
• Check for scripts you didn’t deploy. Look through recently pushed scripts and tools on managed computers for anything your team didn’t send.
• If you used N-central’s built-in remote control, switch to Take Control for now. N-able has disabled built-in remote control until a later fix; Take Control still works.