N-able pulls N-central offline after zero-day dump

N-able took its entire hosted N-central platform offline across the Americas, Europe, and Asia-Pacific on November 9, the day after security researcher Sean Bales publicly disclosed 33 zero-day flaws in the RMM product without telling the company. Proof-of-concept exploit code for the bugs is on GitHub. Shadowserver counted 1,338 N-central servers exposed online that Monday. By Tuesday the figure was down to 148.

The fix is N-central 2026.4 HF2, build 2026.4.1.26, released Tuesday. It covers seven CVEs out of the set Bales disclosed under the name Able2Shell:

• CVE-2026-125883, multiple XXE vulnerabilities
• CVE-2026-125878, multiple OGNL injection vulnerabilities
• CVE-2026-125879, local privilege escalation to root via a nable-writable syslog-ng config
• CVE-2026-125880, stored XSS via MMS3 patch metadata in an admin context
• CVE-2026-125881, schema-hint SSRF through service-import schema validation
• CVE-2026-125882, RCE via file-repository upload path traversal, credited to Nate Fair of Sprocket Security
• CVE-2026-91000, insecure IPC channels leading to local privilege escalation

N-able says further security updates are coming, so seven is not the final count. Bales listed 33 separate issues, though Tenable’s Research Special Operations notes several of those are individual steps in longer chains rather than standalone bugs. Bales described four exploit chains.

The one worth your attention is the XXE chain. Bales demoed an unauthenticated flaw in N-central’s service-import functionality that steals a trusted local session, resets the targeted account’s password, and executes commands on the server as the nable user. From there an attacker can create a Default Administrator account with their own credentials and take rogue control of the management console. Tenable notes the researcher describes the chain as credential-free, and N-able’s own record for CVE-2026-125883 lists no privileges and no user interaction required. An unauthenticated network request becomes a full compromise of a central IT management system.

That full compromise is the point with an RMM console. N-central runs script execution, software deployment, and remote administration across thousands of endpoints at once, and the other flaws let an attacker who is already in take over privileged internal sessions and reach the managed estate below. For an MSP running many clients from one platform, that is a path to cross-customer compromise. N-able serves more than 500,000 organizations in over 140 countries.

Bales says he dropped the zero-days without notifying N-able because the company allegedly ignored vulnerabilities he reported in a different N-able product five to six months earlier, including two unrelated RCE bugs and a privilege-escalation flaw. N-able rejects that account: “Claims that N-able ignored responsible disclosure from the researcher are inaccurate. The new vulnerabilities that the researcher published on November 9 were not responsibly disclosed through our established reporting channels.” The flaws affect N-central Appliance 2026.4.0.31, a pre-release build, and Bales believes most or all of them reach earlier versions too.

N-able has not flagged any of the flaws as exploited in the wild, but scanning has already started. Defused reported probing within 24 hours of the public drop: anonymous agent sessions being opened, appliance config being pulled, and the remote-control endpoint being hit without auth, all paths on the exploit surface.

What to do now

Hosted customers on NCODs are already upgraded and back online in every region. On-premises operators should apply HF2 before restoring internet access, following N-able’s published upgrade steps rather than reopening first; earlier guidance was to keep servers offline until the fix shipped.

Preserve logs before you change anything. Then review login and authentication activity from November 8 onward, as Huntress advised. Unexpected access in that window could mean RCE or privilege escalation already happened, and if you find it, bring in incident response. Check audit logs for secondary indicators too: anomalous remote-access sessions and new scripts being deployed. In earlier N-central incidents, attackers sprayed downstream environments with unauthorized scripts and tools.

N-central has been through this before. CISA added CVE-2025-8875 and CVE-2025-8876 to its Known Exploited Vulnerabilities catalog in August 2025 after in-the-wild exploitation. In August 2026, attackers exploited an authentication-bypass flaw, CVE-2026-18556, then worked around N-able’s first fix through a related bug, CVE-2026-18577, to gain admin access and abuse the Take Control feature to reach managed systems.

Action1 field CTO Gene Moody’s read is that MFA and role-based access will not contain a platform compromise once the console itself is owned. His harder recommendation for N-able environments is to keep critical secrets and signing keys off the platform and have endpoints independently verify a cryptographically signed approval before running high-impact operations, so that stealing a credential, or even controlling the console, does not by itself authorize the dangerous action.