Critical vulnerabilities in N-able N-central prompt hosted shutdown
On November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform.
On November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform.
In a public disclosure titled Able2Shell, an independent researcher has published details and proof-of-concept (PoC) code covering 33 issues.
According to the disclosure, the issues include unauthenticated remote code execution (RCE), privilege escalation to root, credential disclosure, and unauthorized account creation.
Before the hotfix release on November 10, N-able reported scanning activity associated with the published PoC code and said it had no evidence that any customer environment had been successfully exploited.
Given the platform's administrative reach and the availability of public exploit code, Rapid7 recommends treating the current disclosure as an emergency.
One unauthenticated chain combines XML external entity (XXE) and session-handling weaknesses to execute code as the nable service account, and other demonstrated chains involve an administrator viewing malicious patch metadata or use ProductAdmin credentials.
Compromise of an RMM server can put downstream managed environments at risk; affected versions: The researcher reports testing N-central Appliance 2026.4.0.31.
That notice did not yet include CVE identifiers or CVSS scores, and n-central is used by managed service providers (MSPs) and enterprise IT teams to administer endpoints and infrastructure.
N-central has previously been targeted through separate vulnerabilities, including an authentication bypass covered by Rapid7 in August 2026.
The vendor advised keeping N-central deployments offline while it developed and validated a hotfix; update #1: On November 10, 2026, N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26), addressing seven CVEs.
On November 11, N-able confirmed that hosted N-central servers across all regions had been successfully upgraded.
Rapid7 strongly recommends that organizations operating on-premises N-central servers upgrade to N-central 2026.4 Hotfix 2 (build 2026.4.1.26) on an emergency basis outside of normal patching cycles, and keep servers offline until successfully upgraded.
What happened
On November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform.
In a public disclosure titled Able2Shell, an independent researcher has published details and proof-of-concept (PoC) code covering 33 issues.
According to the disclosure, the issues include unauthenticated remote code execution (RCE), privilege escalation to root, credential disclosure, and unauthorized account creation.
What changed
Before the hotfix release on November 10, N-able reported scanning activity associated with the published PoC code and said it had no evidence that any customer environment had been successfully exploited.
Given the platform's administrative reach and the availability of public exploit code, Rapid7 recommends treating the current disclosure as an emergency.
Who is affected
One unauthenticated chain combines XML external entity (XXE) and session-handling weaknesses to execute code as the nable service account, and other demonstrated chains involve an administrator viewing malicious patch metadata or use ProductAdmin credentials.
Why it matters
Compromise of an RMM server can put downstream managed environments at risk; affected versions: The researcher reports testing N-central Appliance 2026.4.0.31.
Technical details
That notice did not yet include CVE identifiers or CVSS scores, and n-central is used by managed service providers (MSPs) and enterprise IT teams to administer endpoints and infrastructure.
N-central has previously been targeted through separate vulnerabilities, including an authentication bypass covered by Rapid7 in August 2026.
Response
The vendor advised keeping N-central deployments offline while it developed and validated a hotfix; update #1: On November 10, 2026, N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26), addressing seven CVEs.
What security teams should do
Rapid7 strongly recommends that organizations operating on-premises N-central servers upgrade to N-central 2026.4 Hotfix 2 (build 2026.4.1.26) on an emergency basis outside of normal patching cycles, and keep servers offline until successfully upgraded.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.