Overview
On November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform.
In a public disclosure titled Able2Shell, an independent researcher has published details and proof-of-concept (PoC) code covering 33 issues. According to the disclosure, the issues include unauthenticated remote code execution (RCE), privilege escalation to root, credential disclosure, and unauthorized account creation. One unauthenticated chain combines XML external entity (XXE) and session-handling weaknesses to execute code as the nable service account. Other demonstrated chains involve an administrator viewing malicious patch metadata or use ProductAdmin credentials. Rapid7 Intelligence is currently triaging the newly published details.
As of November 10, N-able reported scanning activity associated with the published PoC code and said it had no evidence that any customer environment had been successfully exploited. The vendor has advised keeping N-central deployments offline while it develops and validates a hotfix. Hosted N-central classic environments remain offline, according to the same notice. N-able's notice does not yet include CVE identifiers or CVSS scores.
N-central is used by managed service providers (MSPs) and enterprise IT teams to administer endpoints and infrastructure. Compromise of an RMM server can put downstream managed environments at risk. N-central has previously been targeted through separate vulnerabilities, including an authentication bypass covered by Rapid7 in August 2026. Given the platform's administrative reach and the availability of public exploit code, Rapid7 recommends treating the current disclosure as an emergency.
Mitigation guidance
Rapid7 strongly recommends that organizations operating on-premises N-central servers take them offline immediately and keep them offline until the hotfix is available, and the server has been successfully upgraded. Hosted customers should follow the vendor's service restoration updates. N-able is developing and validating a hotfix, with a target of midday November 10 EST.
- Affected versions: The researcher reports testing N-central Appliance 2026.4.0.31. N-able's current notice does not specify the full affected-version range.
Affected versions: The researcher reports testing N-central Appliance 2026.4.0.31. N-able's current notice does not specify the full affected-version range.
- Fixed versions: N-able's incident notice does not yet identify a remediation build. Follow the incident notice for release confirmation and installation instructions.
Fixed versions: N-able's incident notice does not yet identify a remediation build. Follow the incident notice for release confirmation and installation instructions.
Rapid7 also recommends reviewing N-central servers and downstream managed systems for signs of compromise and engaging incident responders if suspicious activity is identified.
For the latest mitigation guidance, please refer to N-able's security incident notice.
Updates
- November 10, 2026: Initial publication.
November 10, 2026: Initial publication.
