CVE-2026-91000: 
N-central Analyse et atténuation de la vulnérabilité

CVE-2026-91000 is a missing authentication for critical function vulnerability (CWE-306) in N-able N-central that enables local privilege escalation. It affects all N-central versions before 2026.4.1 and was published on November 10, 2026. The vulnerability is classified as High severity with a CVSS v4.0 base score of 8.4, assigned by N-able (GitHub Advisory, N-able Advisory).

The vulnerability is rooted in insecure inter-process communication (IPC) channels within N-able N-central that expose critical functions without requiring authentication (CWE-306). An attacker with low-level local access can invoke these unprotected IPC endpoints to escalate their privileges within the N-central system without any additional preconditions or user interaction. The attack vector is local, requires low privileges, and has no attack complexity or requirements beyond initial local access (GitHub Advisory, N-able Advisory).

Successful exploitation allows a low-privileged local attacker to escalate privileges within the N-central management platform, resulting in high confidentiality and integrity impact on the vulnerable system. Because N-central is a remote monitoring and management (RMM) platform used to manage large numbers of endpoints, privilege escalation within it could enable an attacker to pivot to managed devices, access sensitive configuration data, credentials, and customer environments. Availability impact is rated low, and there is no assessed impact on subsequent systems (GitHub Advisory, N-able Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting low current exploitation probability. The CVE status is "Received" and it has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, media coverage noted that N-able released an emergency hotfix (N-central 2026.4 HF2) shortly after a mass vulnerability disclosure involving 33 exploits, suggesting heightened risk context (CSO Online).

1. Local Access: Obtain low-privileged local access to the system running N-able N-central (e.g., via a compromised service account, shared hosting environment, or insider access).
2. Identify IPC Channels: Enumerate local inter-process communication channels (e.g., named pipes, sockets, or local API endpoints) exposed by the N-central application that lack authentication controls.
3. Invoke Critical Function: Send a crafted request directly to the unauthenticated IPC endpoint that exposes a privileged function, bypassing any authentication checks.
4. Achieve Privilege Escalation: The unprotected function executes with elevated privileges, granting the attacker higher-level access within the N-central platform, potentially including administrative control over managed endpoints (N-able Advisory, GitHub Advisory).

• Logs: Unexpected privilege escalation events or administrative actions in N-central audit logs originating from low-privileged accounts; anomalous access to critical N-central functions without corresponding authentication events.
• Process: Unusual child processes or elevated-privilege processes spawned by the N-central service or associated IPC handlers.
• Network: Unexpected administrative actions on managed endpoints initiated from the N-central server, particularly outside of normal maintenance windows.
• File System: Unauthorized changes to N-central configuration files or addition of new administrative accounts within the platform.

N-able has released a patch in N-central version 2026.4.1 (delivered as hotfix HF2), and all users should upgrade immediately (N-able Advisory, N-able Status). N-able also took its cloud-hosted N-central service offline temporarily in response to the broader vulnerability disclosure, and customers running on-premises instances were advised to follow suit until patched (Cyber Daily). As interim mitigations, restrict local and network access to N-central administrative interfaces, enforce least-privilege principles for accounts with local system access, and monitor audit logs for unauthorized privilege escalation activity.

CSO Online reported that N-able issued an emergency fix for N-central just two days after a mass disclosure of 33 exploits, highlighting the urgency of the patch (CSO Online). Tenable published a FAQ blog post titled "Able2Shell" addressing the reported N-central zero-day vulnerabilities, indicating significant researcher and vendor community attention (Tenable Blog). Cyber Daily reported that N-able took its cloud service offline and advised on-premises customers to do the same, underscoring the severity of the broader disclosure event (Cyber Daily). Security Online also covered the N-central vulnerabilities in the context of the patch and associated PoC scanning activity (Security Online).