Build Number: 2026.4.1.26
Last Updated: November 10th, 2026
N-central 2026.4 Hotfix 2 – Security Update
N-central 2026.4 Hotfix 2 is a critical security update. It includes a number of security patches and technology updates that improve the overall security of N-central. This hotfix strengthens the following areas:
- Authentication and access control. We have strengthened authentication and permission checks on the server.
- Legacy mobile device management (MDM). We have removed legacy mobile device management.
- File upload and log handling. We have added additional validation to file and log handling.
- Server hardening. We have added additional hardening to server components.
- Agent and Probe security. We have added additional hardening to the Agent and Probe communication.
- Web and sign-in protections. We have strengthened web and sign-in protections.
- Operating system and third-party updates. We have updated the server operating system and third-party components.
To keep your environment protected, customers running on-premises N-central deployments should upgrade their servers as soon as possible. Hosted N-central servers are upgraded by N-able. All customers, both hosted and on-premises, must upgrade their Agents and Probes.
Agent and Probe Communication Update
This hotfix updates legacy components of the Agent and Probe, which changes how the two communicate. As a result, whether an Agent can communicate with a Probe depends on the versions of the Agent, Probe, and Patch Management Engine (PME) in your environment. Features that rely on this communication, such as the offline patch cache, are unavailable when the versions are not compatible.
The updated Agent and Probe packages are included in this hotfix. The updated PME is delivered separately and is pushed automatically ahead of the hotfix release, so no action is required for PME.
N-able upgrades hosted servers, but Agents and Probes must be upgraded by the customer in both hosted and on-premises environments.
Agents and Probes can be upgraded independently of each other. To maintain Agent-to-Probe communication, upgrade Agents first, then Probes.
Compatibility:
- Probe not upgraded to 2026.4.1.26 or later: Agents continue to communicate with the Probe as they do today, regardless of the Agent and PME versions. Agents and PME running 2026.4.1.26 or later remain compatible with earlier Probe versions, allowing Agent and PME upgrades to be completed in stages.
- Probe, Agent, and PME upgraded to 2026.4.1.26 or later: Agents communicate with the Probe using the updated communication method.
- Probe upgraded to 2026.4.1.26 or later, but Agent or PME not upgraded: Agents cannot communicate with the upgraded Probe until both the Agent and PME are also upgraded to 2026.4.1.26 or later. Features that depend on this communication, such as the offline patch cache, are unavailable until the required upgrades are completed. Earlier PME versions are not compatible with a Probe running 2026.4.1.26 or later.
Download links:
N-central CMMC Download (For CMMC Subscribed Accounts)
Known Issues:
Built-in remote control is temporarily disabled. N-central’s built-in remote-control functionality is currently unavailable and will be re-enabled in a future fix. Take Control continues to work as expected.
Additional Information
This release supersedes N-central 2026.4 (build 2026.4.0.27) and N-central 2026.4 Hotfix 1 (build 2026.4.0.32). To learn what is included in the 2026.4 release, see N-central 2026.4 Release
Hosted N-central – No server action required
If you are on an N-central hosted instance (NCOD), N-able will upgrade your server for you. You do not need to upgrade your server. You must still upgrade your Agents and Probes. See Agent and Probe Communication Update above.
N-central (on-premises) – How do I upgrade to the hotfix?
On-premises customers must upgrade their own servers and must also upgrade their Agents and Probes.
- Download and upgrade to 2026.4.1.26 using the instructions provided below and, on the N,-able support portal. If you need assistance with the upgrade process, please contact our support team at: https://me.n-able.com/s/
- Upgrade Documentation: https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/InstallConfig_Upgrade.htm
- Upgrading from legacy versions: https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Release_Notes/upgrade_path.htmHow To Upgrade Legacy versions (2020.1 to 2022.6) to 2026.3How To Upgrade Legacy versions (2020.1 to 2022.6) to 2026.3
The following CVEs have been released and fixed with the hotfix:
- CVE-2026-125883 – Multiple XXE Vulnerabilities
- CVE-2026-125878 – Multiple OGNL Injection vulnerabilities
- CVE-2026-125879 – Local privilege escalation to root via nable-writable syslog-ng config
- CVE-2026-125880 – Stored XSS via MMS3 patch metadata (admin context)
- CVE-2026-125881 – Schema-hint SSRF via service import schema validation
- CVE-2026-125882 – RCE via file repository upload path traversal (Credit Nate Fair, Sprocket Security)
- CVE-2026-91000 – Insecure IPC Channels lead to local privilege escalation
Supported Upgrade Paths
The following upgrade paths are supported for 2026.4 HF2: Build Number: 2026.4.1.26
| Upgrading From | Supported |
| 2025.4 | Yes |
| 2026.1 | Yes |
| 2026.2 | Yes |
| 2026.3 | Yes |
| 2026.3.1 (Hotfix 1 to Hotfix 4) | Yes |
| 2026.4 (build 2026.4.0.27) | Yes |
| 2026.4 (Hotfix 1, build 2026.4.0.32) | Yes |
| Earlier | No – upgrade to a supported version first |
If you are on an older version, we recommend you upgrade to any of the builds above, then upgrade to this hotfix version ASAP. For more information, see the above Upgrade path for legacy N-central versions.
If you are unsure of what to do, you can contact support directly.
Do I need to update my agents too?
Yes. Both hosted and on-premises customers need to upgrade their Agents and Probes.. For compatibility details, see Agent and Probe Communication Update above.
For More Information:
Support: https://me.n-able.com/s/
Uptime Page: https://uptime.n-able.com/