N-able N-central: 33 zero-days published, hotfix fixes 7 CVEs
Able2Shell puts an unauthenticated XXE-to-root chain in the RMM console MSPs run

N-able N-central: 33 zero-days published, hotfix fixes 7 CVEs

N-able took every hosted N-central environment offline on 9 November after a researcher published 33 alleged zero-days with working exploit code. A hotfix released the next day fixes seven of them.

What happened

Sean Bales, publishing under the GitHub handle Oracle-Security, released a repository called Able2Shell containing proof-of-concept exploits for 33 flaws in N-central, the remote monitoring and management platform MSPs use to administer client networks. He tested them against N-central Appliance 2026.4.0.31, a pre-release build, and said most, if not all, should also work on earlier versions.

N-able responded by taking hosted N-central offline across the Americas, Europe and Asia-Pacific, and by telling on-premises customers to shut their servers down. N-central 2026.4 Hotfix 2, build 2026.4.1.26, arrived on 10 November with fixes for CVE-2026-125883 (XXE), CVE-2026-125878 (OGNL injection), CVE-2026-125879 (privilege escalation to root), CVE-2026-125880 (stored XSS in an admin context), CVE-2026-125881 (SSRF), CVE-2026-125882 (RCE via upload path traversal) and CVE-2026-91000 (insecure IPC channels). N-able says a follow-up hotfix will cover the remainder, and that Hotfix 2 temporarily disables the platform's built-in remote control.

The chain that matters is the XXE one. A single unauthenticated request to the service-import function can steal a trusted local session, reset an account password and run commands as the nable user. The same chain can create a Default Administrator account with attacker-chosen credentials, which hands over the console that manages every device underneath it.

Who is affected

  • Any organisation running N-central on-premises, including MSPs that administer client estates from it
  • Customers of N-able's hosted N-central service, which was offline while servers were upgraded
  • N-central Appliance 2026.4.0.31 and, according to the researcher, earlier builds as well

What to do now

Get on-premises N-central to Hotfix 2 before reconnecting it, then treat the server as possibly compromised.

  • Install build 2026.4.1.26 and follow N-able's upgrade guidance before restoring normal access
  • Look for Default Administrator accounts and admin sessions you cannot account for
  • Reset console credentials, and rotate the device credentials stored in N-central
  • Review logs for anonymous agent sessions, appliance configuration pulls and unauthenticated calls to the remote control endpoint
  • Restrict console access to management networks and confirm MFA is enforced

What this means for South African businesses

If your IT provider runs N-central, this is not only their problem: the console holds credentials to your servers, endpoints and network gear, so a compromised RMM is a route into every client it manages. An SME has no way to see that from the inside, which is why the question worth asking is which RMM your provider runs and whether it is on Hotfix 2. My read is that the exposure window is short and public: the exploit code shipped with the disclosure, the CVEs only appeared on the 10th, and internet scanning for exposed N-central servers has already been observed.

Source: BleepingComputer.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

ASUS router CVE-2026-88710: CVSS 8.7 root access from the local network
Four firmware flaws were fixed on 10 November across the 386, 388 and 102 router series, and the worst needs no credentials at all