N-able N-central Able2Shell Hotfix: Patch Seven Flaws and Upgrade Agents Before Probes

What happened, in order​

Researcher Sean Bales disclosed the flaws late on Sunday, November 8, without telling N-able first. BleepingComputer reported that he published proof-of-concept exploits in a GitHub repository called Able2Shell. Field Effect's security intelligence team traced the disclosure to a GitHub account named Oracle-Security. As WindowsForum noted in its earlier coverage, the two accounts don't necessarily conflict, because a named researcher can publish under a handle. Tenable dates the earliest README commit to November 9 at 04:14 UTC.

Bales told BleepingComputer why he skipped coordinated disclosure. He says that about five to six months ago he reported other flaws to N-able in a different product, including two remote code execution bugs and a privilege escalation, and they were never patched. When BleepingComputer asked N-able about those claims, the company didn't answer them. It replied with a statement about the incident and the shutdown. Readers should keep both points in mind: the researcher's reasons haven't been verified, and the vendor has so far declined to address them.

N-able acted quickly. On November 9 it took every hosted N-central environment offline in the Americas, Europe and Asia-Pacific. It also told on-premises customers to take their own servers offline until further notice. A day later the fix shipped. Huntress reports that on November 10, N-able released N-central 2026.4 HF2, (build 2026.4.1.26) to address the Able2Shell vulnerabilities disclosed the day before, stating that all hosted servers had been upgraded and brought back online. Sources disagree slightly on the date. Rapid7 says that on November 11, N-able confirmed that hosted N-central servers across all regions had been successfully upgraded. Either way, hosted servers are back online. On-premises servers are the open question.

Section summary: The researcher went public on November 8, hosted N-central went offline on November 9, the hotfix shipped on November 10, and hosted servers have now been upgraded. On-premises customers still have to do the work themselves.

The scope: 33 alleged findings, 7 confirmed CVEs​

The two numbers in this story are easy to mix up. Rapid7 describes a disclosure covering 33 issues, and says the researcher claims they include unauthenticated remote code execution (RCE), privilege escalation to root, credential disclosure, and unauthorized account creation. Hotfix 2 fixes seven CVEs. Tenable points out that N-able hasn't said which of the 33 findings each CVE covers. So nobody should read Hotfix 2 as a fix for all 33.

Here are the seven CVEs, with descriptions from N-able's release notes and the CVSS v4 scores Tenable lists:

Tenable adds that CVE-2026-91000 was reserved on September 14, before Able2Shell went public. That suggests at least one of these bugs was already known to N-able.

N-able's status page says a follow-up hotfix will bring further security updates, and Rapid7 confirms that the vendor plans a follow-up hotfix with further security updates. No date or contents have been published.

Section summary: Seven CVEs are fixed, rated 8.3 to 9.3, and more fixes are expected. Don't treat Hotfix 2 as the end of this.

Why a compromised N-central server is so dangerous​

N-central is an RMM console. MSPs and IT departments use it to monitor, manage and push changes to every endpoint they look after. Taking over that server gives an attacker a ready-made way to reach every client network it manages.

The exploit chain that worries researchers most is unauthenticated. Bales demonstrated an XXE-to-RCE chain that abuses N-central's service-import feature to steal a trusted local session, reset an account password and run commands on the server as the nable user. The same exploit can create a Default Administrator account with credentials the attacker chooses, which gives full access to the management console.

Tenable groups the published research into four chains:

• Service import XXE: no login needed. Runs commands as the nable account. N-able's own record for CVE-2026-125883 lists no required privileges and no user interaction.
• MMS3 stored XSS to OGNL execution: the payload can be planted without logging in, but it only fires when an administrator views the poisoned patch details. Runs commands as nable.
• MMS3 stored XSS to Audit Export: same trigger. Reportedly reaches root.
• SIS file path traversal to syslog installer: requires a login. Reportedly reaches root.

Section summary: One chain needs no credentials at all, two reach root, and the target is a server that manages every endpoint behind it.

Exploitation status: scanning yes, confirmed breaches no​

Some headlines have gone further than the evidence, so precision matters here. Defused Cyber reported probing for the zero-days and said, according to The Hacker News, "We have seen opening of anonymous agent sessions, pulling appliance config and hitting the remote control endpoint without auth". The Hacker News also reports that watchTowr "observed exploitation attempts against N-able N-central honeypots overnight following the 'Able2Shell' zero-days being dropped."

N-able, for its part, confirmed that it's seeing "scanning activity associated with the published proof-of-concept code" but emphasized there is no evidence of successful exploitation in any customer environment. Huntress said on November 10 that it had seen no Able2Shell exploitation in its partners' environments. Previdian's decoys logged 68 events from one source IP, including XXE attempts. Previdian says those events don't show a completed account takeover or command execution.

According to SecurityOnline, none of the seven CVEs appears in CISA's Known Exploited Vulnerabilities catalog yet. That only tells you when CISA last updated the catalog. It doesn't prove nobody has been hacked.

Shadowserver's numbers suggest admins took the shutdown advice seriously. Internet-exposed N-central servers dropped from 1,338 on Monday to just over 148.

There is also history behind the urgency. Tenable lists five earlier N-central CVEs already in the KEV catalog, three of them added in August and September 2026. GBHackers notes that attackers exploited CVE-2026-18577 to gain administrative control and abuse the Take Control feature. Attackers have targeted N-central before, and this disclosure handed them working exploit code.

Section summary: Expect active scanning and attempts against honeypots. No customer compromise has been confirmed as of November 10, but given past attacks on N-central, that's no reason to relax.

How to apply N-central 2026.4 Hotfix 2​

This list is based on N-able's release notes. Use N-able's upgrade documentation on its support portal as the authoritative procedure.

1. Keep on-premises servers offline until patched. Rapid7 strongly recommends that organizations operating on-premises N-central servers upgrade to N-central 2026.4 Hotfix 2 (build 2026.4.1.26) on an emergency basis outside of normal patching cycles, and keep servers offline until successfully upgraded.
2. Confirm your upgrade path. Supported starting points are 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1 through 4, 2026.4 (build 2026.4.0.27), and 2026.4 Hotfix 1 (build 2026.4.0.32). Anything older has to be upgraded to one of those first. N-able publishes a separate guide for legacy versions 2020.1 through 2022.6.
3. Upgrade the server (on-premises only). Hosted (NCOD) customers don't need to do anything on the server side.
4. Upgrade Agents first, then Probes. This applies to hosted and on-premises customers alike. The hotfix changes how Agents and Probes communicate. GBHackers summarizes the risk: a Probe on 2026.4.1.26 or later cannot talk to Agents that are not also upgraded, and features such as the offline patch cache stop working. Agents and the Patch Management Engine (PME) on the new build still work with older Probes, so you can roll out Agents in stages. N-able pushes the updated PME automatically ahead of the hotfix.
5. Verify success. The server should report build 2026.4.1.26. Agents and Probes should be on 2026.4.1.26 or later, and features that rely on Probes, such as the offline patch cache, should work normally.
6. Plan for a known limitation. Built-in remote control is temporarily disabled and will return in a later fix. N-able says Take Control continues to work.
7. Be aware that legacy MDM is gone. The hotfix removes legacy mobile device management. If any of your workflows depended on it, they'll stop working.

Investigate, don't just patch​

The exploit code was public for about two days before the fix arrived, so patching alone doesn't tell you whether anyone got in during that window. Huntress recommends reviewing login and authentication activity from November 8 onward. Look for unusual remote access sessions, newly deployed scripts and administrator accounts nobody created. An unexpected Default Administrator account is the clearest warning sign, because that's exactly what the XXE proof of concept creates. Beazley Security Labs and Previdian have published network indicators, including source IPs and the SOAP endpoints attackers targeted. Load those into your monitoring.

Analysis: a messy disclosure, a fast fix​

Dropping zero-days without warning on a product that controls thousands of downstream networks put MSP customers at risk. Whatever grievance the researcher had, those customers had no part in it. Still, N-able has offered no public explanation for the earlier reports Bales says it ignored, and N-central has had several KEV-listed flaws this year. Those two facts are why outsiders are now asking how the code base got here.

To N-able's credit, the response was fast and transparent: hosted servers offline the same day, a patched build and CVE records within about 48 hours, and detailed compatibility notes. The real test is the follow-up hotfix. Twenty-six or so of the researcher's alleged findings haven't been mapped to any CVE, so customers have a fair question: which of them are real, and when will they be fixed?

For now, get your server to 2026.4.1.26, upgrade Agents and then Probes, check your logs back to November 8, and watch for the next hotfix.