The Able2Shell flaws include unauthenticated remote code execution and privilege escalation. N-able has released an emergency security update following public disclosure of exploit code.
N-able temporarily shut down its hosted N-central remote monitoring and management (RMM) platform worldwide after a security researcher publicly disclosed 33 vulnerabilities that could allow attackers to execute commands on vulnerable servers, create rogue administrator accounts and escalate privileges to root.
The disclosure, dubbed Able2Shell, includes four exploit chains, three of which can lead to remote code execution. One of the chains reportedly allows an unauthenticated attacker to exploit an XML external entity (XXE) vulnerability to gain access to a trusted session, reset an account password and execute commands on the server.
N-able took its hosted N-central environments offline across the Americas, Europe and Asia-Pacific on November 9, and advised customers running on-premises deployments to shut down their servers until security fixes became available.
The company subsequently released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) on November 10, addressing seven CVE identifiers associated with the disclosure. N-able said it had observed scanning activity associated with the publicly released proof-of-concept code, but had not found evidence of successful exploitation of customer environments.
Exploit chains could compromise N-central servers
Independent security researcher Sean Bales, who publishes research under the GitHub handle Oracle-Security, disclosed the vulnerabilities on November 8 and published proof-of-concept exploits in a repository called Able2Shell.
The research identifies weaknesses across several N-central components, including authentication and session handling, file uploads, patch management and local privilege controls.
The most serious attack chain combines an unauthenticated XXE vulnerability with weaknesses in session handling. An attacker can use the flaw to obtain a trusted local session, reset an account password and execute commands as the N-central service account. The chain can also be used to create a default administrator account with attacker-controlled credentials.
Other attack paths involve exploiting malicious patch metadata that executes when an administrator views it, potentially leading to command execution through cross-site scripting (XSS) and OGNL injection. Another chain exploits a file repository upload weakness to write an executable file into a server directory and subsequently escalate privileges.
Bales tested the exploits against N-central Appliance version 2026.4.0.31, a pre-release build, and indicated that most, if not all, of the vulnerabilities could also affect earlier versions.
N-able’s emergency update identifies seven CVEs covering multiple XXE and OGNL injection vulnerabilities, local privilege escalation, stored XSS, server-side request forgery (SSRF), remote code execution through file-upload path traversal and insecure inter-process communication channels.
MSPs face wider exposure
The vulnerabilities are particularly concerning because N-central is used by managed service providers (MSPs) and enterprise IT teams to remotely monitor, manage and maintain customer endpoints and networks.
An attacker who compromises an N-central server could potentially abuse its administrative access to reach systems managed through the platform. This creates a risk extending beyond the organization operating the vulnerable server to the MSP’s downstream customers.
The disclosure also follows several earlier security incidents involving N-central.
In August 2026, N-able patched an authentication bypass vulnerability, CVE-2026-18556, that was exploited to deploy ransomware. Attackers subsequently found a way around the initial fix, leading to CVE-2026-18577.
In September, researchers identified another series of vulnerabilities, including CVE-2026-86218, a pre-authentication remote code execution flaw that was also exploited in the wild.
The latest disclosure therefore adds to a series of security challenges for a platform with extensive administrative reach across customer environments.
N-able releases emergency security update
N-able’s November 10 hotfix strengthens authentication and permission checks, file-upload validation, server components, web protections and communications between N-central servers, Agents and Probes.
The company has upgraded its hosted N-central servers. Customers running on-premises deployments are required to install the hotfix, while both hosted and on-premises customers must upgrade their Agents and Probes to maintain compatibility.
N-able’s release notes list the following vulnerabilities as addressed:
- CVE-2026-125883: Multiple XXE vulnerabilities
- CVE-2026-125878: Multiple OGNL injection vulnerabilities
- CVE-2026-125879: Local privilege escalation to root
- CVE-2026-125880: Stored cross-site scripting
- CVE-2026-125881: Server-side request forgery
- CVE-2026-125882: Remote code execution through file-upload path traversal
- CVE-2026-91000: Local privilege escalation through insecure IPC channels
N-able has advised customers to follow its upgrade instructions and ensure that all associated components are updated.
N-able Status
Security researchers have also recommended that administrators review authentication activity from November 8 onward, investigate unexpected administrator accounts and remote-access sessions, and assess customer networks managed through potentially affected N-central servers.
