N-able has released a security update for its N-central product, addressing seven vulnerabilities, two of which are deemed critical. The update applies to all versions prior to N-central 2026.4 Hotfix 2 (HF2).

The critical vulnerabilities, identified as CVE-2026-125881 and CVE-2026-125883, both carry a CVSS score of 9.3. Additional vulnerabilities involve improper neutralization of input and privilege assignment, with CVSS scores ranging from 8.3 to 8.7.

Exploitation attempts of these vulnerabilities have been observed in the wild. The NHS England National CSOC has assessed further exploitation as likely, prompting heightened concern.

Organizations using N-central are urged to apply the security update immediately. It is also advised to take N-central servers offline until the patch is fully implemented to mitigate potential risks.