On November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform.
In a public disclosure titled Able2Shell, an independent researcher has published details and proof-of-concept (PoC) code covering 33 issues. According to the disclosure, the issues include unauthenticated remote code execution (RCE), privilege escalation to root, credential disclosure, and unauthorized account creation. One unauthenticated chain combines XML external entity (XXE) and session-handling weaknesses to execute code as the nable service account. Other demonstrated chains involve an administrator viewing malicious patch metadata or use ProductAdmin credentials. Rapid7 Intelligence is currently triaging the newly published details.
Before the hotfix release on November 10, N-able reported scanning activity associated with the published PoC code and said it had no evidence that any customer environment had been successfully exploited. The vendor advised keeping N-central deployments offline while it developed and validated a hotfix. Hosted N-central classic environments were offline, according to the same notice. That notice did not yet include CVE identifiers or CVSS scores.
N-central is used by managed service providers (MSPs) and enterprise IT teams to administer endpoints and infrastructure. Compromise of an RMM server can put downstream managed environments at risk. N-central has previously been targeted through separate vulnerabilities, including an authentication bypass covered by Rapid7 in August 2026. Given the platform's administrative reach and the availability of public exploit code, Rapid7 recommends treating the current disclosure as an emergency.
Update #1: On November 10, 2026, N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26), addressing seven CVEs. The vendor plans a follow-up hotfix with further security updates. On November 11, N-able confirmed that hosted N-central servers across all regions had been successfully upgraded.
Mitigation guidance
Rapid7 strongly recommends that organizations operating on-premises N-central servers upgrade to N-central 2026.4 Hotfix 2 (build 2026.4.1.26) on an emergency basis outside of normal patching cycles, and keep servers offline until successfully upgraded. Hosted servers are upgraded by N-able.
Customers in both hosted and on-premises environments must also upgrade their Agents and Probes. To maintain communication, upgrade Agents first, then Probes, following the vendor's compatibility guidance for the Patch Management Engine (PME).
-
Affected versions: The researcher reports testing N-central Appliance 2026.4.0.31. N-able's current notice does not specify the full affected-version range.
-
Fixed versions: N-central 2026.4 Hotfix 2 (build 2026.4.1.26) addresses the seven CVEs listed below.
According to N-able's release notes, the hotfix addresses:
CVE
Description
Multiple XXE vulnerabilities
Multiple OGNL injection vulnerabilities
Local privilege escalation to root through nable-writable syslog-ng configuration
Stored XSS through MMS3 patch metadata in an administrator context
Schema-hint SSRF through service-import schema validation
RCE through file-repository upload path traversal; credited to Nate Fair, Sprocket Security
Local privilege escalation through insecure IPC channels
Further security updates are planned in a follow-up hotfix. Organizations should monitor the vendor's guidance and apply subsequent fixes as they become available.
Rapid7 also recommends reviewing N-central servers and downstream managed systems for signs of compromise and engaging incident responders if suspicious activity is identified.
For the latest mitigation guidance, please refer to N-able's security incident notice.
Rapid7 customersExposure Command, Vulnerability Management, and Nexpose
Exposure Command, Vulnerability Management, and Nexpose customers can identify N-able N-central “potential” vulnerabilities based on presence of software with remote unauthenticated checks with the release on November 11th, 2026. Note that potential check type must be enabled in the scan template before scanning.
Unauthenticated checks that validate vulnerable versions are in development.
Intelligence Hub
Customers leveraging Rapid7’s Intelligence Hub can access Suricata detection rules for CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, and CVE-2026-125882.
Updates
-
November 10, 2026: Initial publication.
- November 11, 2026: Added hotfix availability, seven CVE identifiers, hosted upgrade confirmation, and updated remediation guidance. Noted the planned follow-up hotfix.
- November 11, 2026: Added availability of Suricata detection rules within Intelligence Hub.
- November 11, 2026: Added Exposure Command, Vulnerability Management, and Nexpose subsection under the Rapid7
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article:
Critical vulnerabilities in N-able N-central prompt hosted shutdown