# MSP Threat Briefing: November 10, 2026

_November 10, 2026 · LNX Inc._

N-able tells N-central customers to go offline after 33 flaws go public, Barracuda confirms ESG attacks, and Chrome patches an exploited zero-day.

The urgent item today is N-able N-central. A researcher published 33 flaws with working exploit code, and N-able took its hosted service offline. It is telling on-premises customers to shut their servers down until a hotfix ships. Barracuda now confirms attacks on the Email Security Gateway flaws covered last week. Chrome has its eighth exploited zero-day of 2026, and CISA listed an exploited FreeSWITCH flaw that affects VoIP phone systems.

1. Take on-premises N-central servers offline now. Keep them off until N-able publishes the hotfix and says it is safe to restore.
2. Review N-central activity since November 8 for new admin accounts, scripts and remote sessions you did not start.
3. Confirm the Barracuda patch is installed on every ESG, and keep its admin interface off the internet.
4. Push Chrome 157.0.8103.50 or later to every managed device, then relaunch the browser.
5. Upgrade FreeSWITCH to 1.11.3, or set `enable-chat=false` on every SIP profile that does not need chat.

## 1. N-able N-central: 33 flaws published with exploit code, servers offline

Researcher Sean Bales published 33 alleged flaws in N-central, with proof-of-concept code, late on November 8. He did not report them to N-able first, as [reported by BleepingComputer](https://www.bleepingcomputer.com/news/security/n-able-takes-cloud-platform-offline-after-30-plus-zero-days-published/). He tested against N-central Appliance 2026.4.0.31 and believes most of the flaws affect earlier versions too.

[Huntress says](https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains) the flaws form four chains, called Able2Shell. Three lead to remote code execution and one to root. The most serious, per BleepingComputer, needs no login. It can reset an account password, run commands and create a Default Administrator account. None of the flaws has a CVE ID yet.

N-able took its hosted N-central environments offline on November 9. It advised on-premises customers to take their servers offline until further notice. N-able told BleepingComputer it has "not observed active exploitation of these vulnerabilities." It is building a hotfix. No fix had appeared on N-able's [status site](https://status.n-able.com/category/n-central/) when this briefing was written.

N-central was attacked twice earlier this year, through CVE-2026-18577 and CVE-2026-86218, according to [Field Effect](https://fieldeffect.com/blog/n-central-offline-alleged-zero-days). With exploit code public, expect scanning to start fast.

**Who is exposed.** Every MSP running N-central, hosted or on-premises. An attacker with control of the server can push scripts and remote sessions to every managed endpoint at every client.

**What to do.**

- On-premises: take the server offline or block all inbound access to it now. Keep it offline until N-able confirms it is safe.
- Hosted: plan for the outage. Line up another way to reach clients for urgent work, and follow N-able's status page.
- Review N-central logins and authentication from November 8 onward. Look for new administrator accounts, privilege changes and configuration edits.
- Check for scripts, software deployments and remote-control sessions pushed to endpoints that nobody on your team started.
- If you find anything, rotate N-central admin, service account and integration credentials. Treat client networks the server could reach as in scope for incident response.
- When the hotfix ships, install only N-able's official package. Huntress notes the fixed build may not carry a new version number.
- Once restored, keep the management interface off the open internet.

## 2. Update: Barracuda confirms attacks on the ESG flaws

The [November 6 briefing](/news/msp-threat-briefing-2026-11-06/) covered Barracuda's correction that CVE-2026-116606 needs no login, only a route to the admin interface. On November 9 at 9:00pm EST, Barracuda [updated its advisory](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) to report exploitation affecting a small number of organizations.

Chained with CVE-2026-111560, the bypass gives root on the Email Security Gateway. The command injection also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. On those products it needs an administrator login. Neither flaw is on CISA's exploited list yet. Barracuda has not published indicators, as [reported by BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/).

**Who is exposed.** Clients with an Email Security Gateway whose admin interface is reachable from the internet or a broad internal network, and where the patch did not install.

**What to do.**

- Confirm the ESG patch is applied: BNSF-40425 on 9.4.017 and later, or BNSF-40430 below 9.4.017.
- Turn automatic patching back on where it was disabled.
- Restrict the admin interface to trusted internal management networks.
- Patch the other five products: BNADC-16586 for ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for Web Security Gateway.
- Where an ESG admin interface was exposed before patching, review admin logins and configuration changes, and contact Barracuda support.

## 3. Chrome patches its eighth exploited zero-day of 2026

Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux on November 9, per its [release notes](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html). The update fixes nine flaws. Google says "an exploit for CVE-2026-125350 exists in the wild." That flaw is a high-severity use-after-free in Chrome's XML component, reported anonymously on November 6.

Google has not said who is behind the attacks or who was targeted. BleepingComputer [counts it](https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/) as the eighth Chrome zero-day exploited this year.

**Who is exposed.** Every client with Chrome on desktops. Other Chromium-based browsers, such as Edge and Brave, need their own updates once their vendors ship them.

**What to do.**

- Push 157.0.8103.50 or later through your management tool. Chrome rolls out over days or weeks if left alone.
- The fix applies only after a relaunch. Enforce one with the `RelaunchNotification` policy, or report on devices still running an older build.
- Watch for Edge and other Chromium browser updates that pick up the fix.

## 4. FreeSWITCH flaw lets one SIP message run server commands

CISA [added CVE-2026-116779](https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog) to its exploited list on November 9, with a federal deadline of November 12. The flaw, rated 9.8, is in FreeSWITCH, an open-source telephony engine. Some hosted VoIP and PBX platforms are built on it.

SignalWire's [advisory](https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p), published October 28, says "exploitation of this path has been observed in the wild." A crafted SIP MESSAGE can run FreeSWITCH API commands, including operating system commands. That exposes configuration, credentials and call control. Versions before 1.11.3 are affected. Chat handling is on by default in the stock profiles.

Where message authentication is on, any single extension, handset or trunk account is enough. Systems that still carry the sample `default` directory user, which has no password, need no account at all.

**Who is exposed.** Clients who run their own FreeSWITCH server or a phone system built on it, especially with SIP reachable from the internet. Ask your VoIP provider whether their platform uses FreeSWITCH and when they patched.

**What to do.**

- Upgrade to FreeSWITCH 1.11.3. The new `enable-chat-api-proto` setting is off by default; leave it off.
- If you cannot upgrade yet, set `enable-chat=false` on every SIP profile that does not need chat. SignalWire says tightening the inbound ACL does not help.
- Remove directory users with no `password` or `a1-hash`, including the stock `default` user.
- Set `disable_system_api_commands=true`. It narrows what an attacker can run but does not close the hole.
- Review the server for unexpected processes, new files and outbound connections.

## Quick hits

**Update: CISA lists the OpenSSH "SSHole" bypass.** The flaw covered on [November 6](/news/msp-threat-briefing-2026-11-06/) and [November 7](/news/msp-threat-briefing-2026-11-07/), CVE-2026-123158, joined CISA's exploited list on November 9, with a federal deadline of November 12. Nothing else has changed. Patch OpenSSH on Alpine and other musl-based hosts, or set `PasswordAuthentication no`.

**Fortinet and Microsoft publish today.** Fortinet said it would publish CVE IDs and details for its October 22 fixes on November 10, as covered in the [October 25 briefing](/news/msp-threat-briefing-2026-10-25/). Its PSIRT page had not posted them when this briefing was written. Expect attention on any FortiGate still below 8.0.2, 7.6.8, 7.4.13 or 7.2.14. Microsoft's November Patch Tuesday also lands today. Tomorrow's briefing will cover both.

## Sources

- [BleepingComputer: N-able takes cloud platform offline after 30+ "zero-days" published](https://www.bleepingcomputer.com/news/security/n-able-takes-cloud-platform-offline-after-30-plus-zero-days-published/)
- [Huntress: N-able disables cloud services following disclosure of Able2Shell exploit chains](https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains)
- [Field Effect: N-able takes N-central offline as alleged zero-day exploits surface](https://fieldeffect.com/blog/n-central-offline-alleged-zero-days)
- [N-able status: N-central posts](https://status.n-able.com/category/n-central/)
- [Barracuda: pre-authentication authorization bypass and command injection advisory](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection)
- [BleepingComputer: hackers now exploit critical Barracuda ESG flaws to gain root access](https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/)
- [Google: Stable Channel Update for Desktop, November 9, 2026](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html)
- [BleepingComputer: Google patches eighth Chrome zero-day exploited in attacks this year](https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/)
- [CISA: CISA adds four known exploited vulnerabilities to catalog, November 9, 2026](https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog)
- [SignalWire: FreeSWITCH advisory GHSA-mg63-h38w-8p9p](https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p)