N-able pulls N-central offline over 33 zero-days, ships fix for seven

Late on Sunday, November 8, an independent researcher published proof-of-concept code for 33 alleged vulnerabilities in N-able N-central to a GitHub repository named Able2Shell. N-central is a remote monitoring and management (RMM) platform that managed service providers use to patch and remotely control their clients' PCs and servers, so one N-central server has administrator access to every network it manages. N-able received no advance notice and called the release "non-responsible communication of critical vulnerabilities."

On Monday, November 9, N-able took its hosted N-central service offline in the Americas, Europe, and Asia-Pacific and told on-premises customers to shut their servers down until further notice. On Tuesday it released N-central 2026.4 Hotfix 2, build 2026.4.1.26, upgraded every hosted server, and promised an undated follow-up hotfix.

The researcher told BleepingComputer he skipped coordinated disclosure because N-able had not fixed bugs he reported five to six months earlier in another of its products.

Seven CVEs fixed in build 2026.4.1.26

N-able has not mapped its CVEs to the 33 published findings. The Hotfix 2 release notes list seven:

• CVE-2026-125883: multiple XML external entity (XXE) flaws
• CVE-2026-125881: server-side request forgery through service import schema validation
• CVE-2026-125878: multiple OGNL injection flaws
• CVE-2026-125879: local privilege escalation to root through a syslog-ng config file the nable account can write
• CVE-2026-125882: remote code execution through path traversal in file repository uploads, credited to Nate Fair of Sprocket Security
• CVE-2026-125880: stored cross-site scripting in MMS3 patch metadata
• CVE-2026-91000: insecure IPC channels allowing local privilege escalation

Tenable lists CVSS 4.0 scores of 9.3 for the XXE and SSRF entries and 8.3 to 8.7 for the rest. N-able treats every version before 2026.4.1 as affected. The researcher tested against 2026.4.0.31, a pre-release build, and wrote that "most if not all vulnerabilities should work on previous versions."

Two of the four published chains reach root

Tenable groups part of the disclosure into four chains. The first abuses XXE in service import, needs no login at all, runs commands as the nable service account, and can create a new console administrator. Two chains plant script in patch metadata without logging in and fire when an administrator views it, one ending in OGNL execution as nable and the other running commands as root through audit export. The fourth needs valid credentials and reaches root through upload path traversal and the syslog installer.

Honeypot attacks within 18 hours, no confirmed compromises

watchTowr reported exploitation attempts against its N-central honeypots the first night. Previdian logged 68 attempts from a single IP address within about 18 hours of publication, including XXE requests and attempts to read sensitive files. Defused saw attackers opening anonymous agent sessions, pulling appliance configuration, and calling the remote control endpoint without authentication. N-able reports scanning tied to the published code and no successful exploitation in a customer environment.

Shadowserver counted 1,338 internet-exposed N-central servers on Monday and just over 148 on Tuesday. Censys reported 1,728.

Third round of emergency N-central fixes since August

In August, N-able patched CVE-2026-18556, an authentication bypass already under attack, then CVE-2026-18577, a bypass of that incomplete fix. A compromise of a fully patched server in early September led to fixes for CVE-2026-86206 and CVE-2026-86207 on September 5 and for CVE-2026-86218, a CVSS 10.0 pre-authentication code execution flaw, on September 6. According to Tenable, CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-18577, CVE-2026-18556, and CVE-2026-86218. None of the seven new CVEs was on that list as of November 10.

Huntress found that August attackers used Take Control under an "MSP Support" account to open sessions on managed machines, went for domain controllers first, and installed Cloudflare tunnels for persistence. The September hotfixes do not protect against Able2Shell.

Upgrade order for on-premises servers

• Keep the server offline or firewalled until it runs 2026.4.1.26. Servers older than 2025.4 need an intermediate upgrade first.
• Upgrade the server, then all Agents, then Probes. An upgraded Probe cannot talk to Agents that are still on the old build, and features such as the offline patch cache stop working until both match. The Patch Management Engine is pushed automatically ahead of the hotfix.
• Built-in remote control is disabled until a later fix (Take Control still works), and legacy MDM is gone.
• Before restoring access, put the web console behind a VPN or an IP allowlist so it stops answering the open internet.
• Review authentication logs from November 8 onward for administrator accounts nobody created, remote sessions nobody scheduled, and scripts pushed outside normal change windows. Beazley Security Labs and Previdian have published attacker IPs and targeted SOAP endpoints.

Hosted customers still upgrade their own Agents and Probes in the same order.

Questions for businesses whose IT provider runs N-central

If an outside provider manages your machines, ask:

• Whether they use N-central, hosted or on their own server, and the date their server reached build 2026.4.1.26.
• Whether the console was reachable from the internet at any point between November 8 and that upgrade.
• Whether they reviewed administrator accounts, Take Control sessions, and scripts touching your machines from November 8 onward.
• Whether they checked your machines for cloudflared or other tunneling and remote access software they did not install, the August persistence method.

Falcon Internet limits the control panels and management ports on the servers we run to our own network ranges, so a flaw in one of those interfaces is not reachable from the open internet.