# N-central: apply HF2 and keep Legacy API disabled Canonical: https://www.oktsec.com/radar/nable-ncentral-able2shell-november-2026 Publisher: Oktsec Language: en Published: 2026-11-14T13:50:39Z Updated: 2026-11-14T13:50:39Z Record reviewed: 2026-11-14T13:50:39Z Latest evidence check: 2026-11-14T13:50:39Z Disclosed: 2026-11-09 HF2 fixes seven N-central CVEs and requires server and endpoint updates, while later disclosures need additional precautions. N-able says HF3 is still in development and has temporarily disabled Intune integration. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Previdian observed attempts against CVE-2026-125883 in sensors. This does not confirm compromise of customer systems or exploitation of the other CVEs. N-able urges HF2 deployment and additional precautions for later disclosures. - Evidence: Attack attempts observed - Verification: Vendor confirmed - Fix status: Additional action required - Exposure requirement: Application or configuration dependent - Vendor: N-able - Products: N-central server, Windows Agents and Probes - CVEs: CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, CVE-2026-91000 ## Technical overview N-able released HF2 on November 10. Its November 11 guidance requires operators of their own servers to keep them off the Internet until the upgrade completes. Hosted servers were updated by N-able; customers still have endpoint work to complete. The November 13 remediation update separates initial fixes from later disclosures. Remaining permission issues require authenticated access. Legacy API abuse requires the API enabled, while Agent impersonation requires an existing endpoint foothold according to the vendor. HF3 is being developed to address further permissions and communication weaknesses and remove Legacy API; it is not a released correction at this review. The separate November 13 response describes Intune deactivation as precautionary and publishes indicators relevant to environments where Legacy API was not disabled. It does not establish that every integration or customer environment was compromised. Previdian reports attempts against CVE-2026-125883 in its sensors from November 9. Those observations do not establish successful compromise or transfer to the other six CVEs. N-able reported scanning associated with public demonstration code on November 11 without indications of compromise in its hosted servers. Each statement has a different scope and observation period. ## Recommended response Apply HF2, update Agents before Probes and keep Legacy API disabled. Check Intune restrictions and investigate suspicious activity; HF3 is not yet a released fix in the reviewed vendor update. Relevant to: Operators of N-central and service providers managing customer endpoints through its Agents and Probes. ## CVE attribution - CVE-2026-125883: N-able — N-central. [Source](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/) - CVE-2026-125878: N-able — N-central. [Source](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/) - CVE-2026-125879: N-able — N-central. [Source](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/) - CVE-2026-125880: N-able — N-central. [Source](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/) - CVE-2026-125881: N-able — N-central. [Source](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/) - CVE-2026-125882: N-able — N-central. [Source](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/) - CVE-2026-91000: N-able — N-central. [Source](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/) ## Affected systems and fixes ### N-central servers operated by customers Affected: Installations without the November HF2 corrections. Older releases require the supported intermediate upgrade path. Fixed release / action: 2026.4 HF2, build 2026.4.1.26, for the seven listed CVEs; follow separate precautions for subsequent disclosures. ### Agents and Probes, including hosted deployments Affected: Customer components still requiring the HF2 packages, even when N-able has updated the hosted server. Fixed release / action: Apply the HF2 component packages; upgrade Agents before Probes. Check PME compatibility in the release notes. ### Legacy API, Intune integration and later N-central disclosures Affected: Legacy API abuse requires that API enabled. N-able describes endpoint access as a prerequisite for Agent impersonation. Remaining permission issues require authenticated access. Fixed release / action: Disable Legacy API and retain the temporary Intune restriction. HF3 remains in development in the November 13 vendor update. Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.13 Checked: 2026-11-14T16:03:56.845Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-14T21:07:37.491Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-91000](https://api.first.org/data/v1/epss?cve=CVE-2026-91000): 0.2% probability of observed exploitation in the next 30 days; percentile 9.51%; score date 2026-11-14. - [CVE-2026-125883](https://api.first.org/data/v1/epss?cve=CVE-2026-125883): 0.92% probability of observed exploitation in the next 30 days; percentile 60.76%; score date 2026-11-14. - [CVE-2026-125882](https://api.first.org/data/v1/epss?cve=CVE-2026-125882): 0.55% probability of observed exploitation in the next 30 days; percentile 46.47%; score date 2026-11-14. - [CVE-2026-125881](https://api.first.org/data/v1/epss?cve=CVE-2026-125881): 0.48% probability of observed exploitation in the next 30 days; percentile 41.61%; score date 2026-11-14. - [CVE-2026-125880](https://api.first.org/data/v1/epss?cve=CVE-2026-125880): 0.47% probability of observed exploitation in the next 30 days; percentile 41.34%; score date 2026-11-14. - [CVE-2026-125879](https://api.first.org/data/v1/epss?cve=CVE-2026-125879): 0.4% probability of observed exploitation in the next 30 days; percentile 35.16%; score date 2026-11-14. - [CVE-2026-125878](https://api.first.org/data/v1/epss?cve=CVE-2026-125878): 0.41% probability of observed exploitation in the next 30 days; percentile 36.03%; score date 2026-11-14. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-14T21:07:37.491Z. ## Response checklist 1. **Verify the server correction** — For servers you operate, keep Internet access restricted until HF2 is installed, as N-able directs. Use its supported upgrade path; hosted server updates are managed by the vendor. 2. **Update Agents before Probes** — Customers must update both components, including hosted customers. Follow the release notes to avoid incompatible Agent, Probe and PME combinations interrupting patch cache communication. 3. **Retain Legacy API and Intune precautions** — Confirm Legacy API is disabled. Verify the vendor’s temporary Intune deactivation and contact support if its state is uncertain. These restrictions do not establish that the integration was exploited. 4. **Review prior activity separately from patching** — For environments where Legacy API remained enabled, review the indicators published on November 13. Oktsec recommends preserving relevant logs and investigating suspicious server or endpoint activity; an update alone cannot establish recovery from a compromise. ## Relevance to AI environments Inventory automation and integrations that can reach the management service; their privileges can extend the impact to managed endpoints. ## Sources - [HF2 release notes: build and component upgrade order](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/) — N-able; Vendor notice; checked 2026-11-14T13:50:39Z - [November 11 response: server isolation and scanning observations](https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response) — N-able; Vendor notice; checked 2026-11-14T13:50:39Z - [November 13 remediation: HF2 coverage and HF3 still in development](https://www.n-able.com/blog/n-able-vulnerability-remediation-update) — N-able; Vendor notice; checked 2026-11-14T13:50:39Z - [November 13 precautions: Legacy API, Intune and indicators](https://www.n-able.com/blog/new-security-update-on-n-central) — N-able; Vendor notice; checked 2026-11-14T13:50:39Z - [CVE-2026-125883: sensor attempts, not confirmed customer compromises](https://previdian.com/CVE-2026-125883) — Previdian; Research report; checked 2026-11-14T13:50:39Z ## Editorial record - 2026-11-14T13:50:39Z: Added verified HF2 deployment steps, November 13 precautions and the limits of sensor evidence; HF3 remains pending. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/nable-ncentral-able2shell-november-2026) · [Build a response plan](https://www.oktsec.com/radar/nable-ncentral-able2shell-november-2026#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=nable-ncentral-able2shell-november-2026&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=nable-ncentral-able2shell-november-2026&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.