November 11, 2026 · Eastern time
Start with N-central. N-able has upgraded its hosted servers after Able2Shell, and MSPs still own the Agent and Probe rollout. This edition also covers exploited Barracuda appliance flaws, Ivanti and Configuration Manager updates, and what changed in LogMeIn Resolve.
Security
N-able N-central Hotfix 2
On November 10, N-able released 2026.4 Hotfix 2, build 2026.4.1.26, for affected earlier N-central builds. At 8:04 p.m. ET, the vendor reported that all hosted servers in the Americas, Europe and Asia-Pacific had been upgraded. The incident moved into monitoring. Self-hosted operators must install the server hotfix. MSPs on both deployments should upgrade Agents before Probes and confirm endpoint check-ins, patch-cache connectivity and remote support. N-able says built-in remote control is temporarily disabled and Take Control remains available.
Public proof of concept appeared November 9. N-able reported scanning, and researchers observed honeypot exploitation attempts. Public sources reviewed for this edition have yet to confirm customer compromise. The hotfix addresses seven CVEs, and N-able plans a follow-up. Read the full N-central advisory and recovery checks · N-able hotfix notes
Barracuda Email Security Gateway and related appliances
CISA added CVE-2026-116606 and CVE-2026-111560 to its Known Exploited Vulnerabilities catalog on November 10, after Barracuda reported exploitation at 9 p.m. ET November 9. The authentication bypass affects ESG, and the command injection affects ESG and other appliance lines. For customer-managed ESG, verify BNSF-40425 on firmware 9.4.017 or later, or BNSF-40430 on earlier firmware. Use Barracuda’s patch table for other models. Check past and present administrative interface exposure and review exposed appliances for compromise. Barracuda advisory · CISA KEV catalog · Root Access Guy appliance checklist
Ivanti Endpoint Manager and Cloud Services Application
Ivanti’s November 10 advisories fix a critical unauthenticated SQL injection that can enable code execution in EPM Core (CVE-2026-121653) and a missing-authentication flaw in CSA 5.0.8 (CVE-2026-121683). Ivanti reported no known exploitation at disclosure. For affected customer-managed deployments, upgrade EPM to 2024 SU8 or later and CSA to 5.0.8.1 or later. Verify trusted Core certificates and remote agent check-ins. Ivanti advisories · Root Access Guy Ivanti coverage
Microsoft Configuration Manager
Microsoft disclosed CVE-2026-119991 on November 10. Weak authentication can expose information on customer-managed Configuration Manager 2603 sites below build 5.0.9146.1045. Verify the site build and deploy Microsoft’s security update. Public exploitation remains unconfirmed in the sources reviewed. Microsoft advisory
Product updates
LogMeIn Resolve adds native mobile device management
Android and iOS management is generally available across supported regions on Complete or Dominate MSP plans. MSPs can enroll corporate and BYOD phones and manage them alongside Windows and macOS devices in the Resolve console. GoTo announcement
LogMeIn Resolve expands remote remediation and patch insights
Virtual Technician now supports technician-approved remediation steps on unmanaged Windows devices during Instant Remote Support sessions for all accounts. Accounts with Patch Management also get generally available Pre-Deployment Insights and Patch Failure Insights for reviewing known issues before rollout and triaging failures afterward. November 10 release notes
Root Access Take
After a management server is patched, test the workflows that depend on it. For N-central, a representative endpoint check-in, a working patch cache and an approved support session give the service desk evidence it can use before resuming bulk client work.