According to

N-able has taken its hosted N-central classic environments offline following the public disclosure of critical vulnerabilities in N-central.

The company is also advising customers running on-premises N-central servers to take them offline until further notice while it works on remediation.

N-able says it has not seen active exploitation of the newly disclosed vulnerabilities at the time of its notice.

Since we first published this post, that situation has started to move.

Previdian is now seeing probing activity against the N-central service-import XXE surface used by the newly disclosed Able2Shell attack chain.

We’re monitoring the situation closely.

What Has Been Disclosed

The public research, published under the name Able2Shell , documents a number of vulnerabilities affecting N-able N-central.

One of the more serious chains starts without existing credentials and combines XML external entity processing with weaknesses in N-central’s internal session handling.

The published proof of concept demonstrates a chain capable of:

Establishing an anonymous N-central MMS2 session

Staging attacker-controlled XML content

Triggering external entity processing during service import

Accessing an internal NCI session

Resetting an existing account password

Authenticating using the attacker-selected password

Writing and executing a JSP payload

Executing operating-system commands as the nable service account

Optionally creating an enabled administrator account

The researcher reports successfully testing the chain against N-central Appliance 2026.4.0.31 .

There is currently no publicly assigned CVE for this specific chain .

We are therefore tracking it internally as:

A Public Exploit Is Already Available

Importantly, this is not simply a vulnerability description.

A working public proof of concept has been released showing the full XXE-to-command-execution chain.

That materially changes the situation for defenders. Even where exploitation has not yet been confirmed, public exploit availability lowers the barrier for researchers, scanners and attackers to reproduce the technique.

At the time of writing, VULN-2026-0007 is not listed in CISA’s Known Exploited Vulnerabilities catalog .

That does not mean the vulnerability should be treated as low priority. N-able itself has taken the unusually strong step of taking hosted N-central environments offline and recommending that on-premises customers do the same.

And we are now beginning to see activity against one of the same attack surfaces used by the disclosed chain.

What Previdian Is Seeing

At around 22:00 UTC on 9 November , one of Previdian’s N-central decoys began receiving SOAP requests targeting the service-import functionality used by the newly disclosed Able2Shell attack chain.

The activity came from a single observed source:

The majority of requests targeted:

/dms/services/ServerUI

with additional activity against:

/dms/services/ServerMMS

and a number of related service variants.

Some of the requests were relatively simple method and endpoint tests.

Others went considerably further.

We observed attempts to supply FilePath values referencing local files including:

We also saw traversal attempts such as:

../../../../etc/passwd

Alongside those requests, the source sent XML containing an inline DOCTYPE referencing a remote DTD hosted on its own infrastructure, consistent with testing for out-of-band XXE behaviour.

We also observed remote FilePath values pointing back to the same source.

This is the first time we have seen this particular pattern of service-import XXE probing in our retained N-central telemetry.

But there is an important distinction here.

Is This VULN-2026-0007 Exploitation?

Not yet, based on the evidence we have.

The traffic is targeting the same service-import XXE surface used by the Able2Shell chain, and the timing is notable given that it appeared on the same day the research and public exploit became available.

However, we have not observed the full exploit sequence demonstrated by the public proof of concept.

In particular, we have not seen the distinctive:

SessionHello → ApplianceLogSubmit → service import

sequence used by the published chain.

We have also not observed the later JSP staging, password reset or subsequent payload execution stages.

Our current assessment is therefore:

VULN-2026-0007-related probing of the N-central service-import XXE surface. Full exploitation of the Able2Shell chain has not been confirmed.

That may change quickly if we begin seeing the more distinctive stages of the published chain.

Previdian Customers Have Been Notified

Previdian customers have already been notified VULN-2026-0007 .

Customer exposure has also been validated so teams can determine whether N-central is relevant to their own environment and prioritise action accordingly.

The situation has now progressed to:

A critical vendor incident

Hosted systems taken offline

On-premises shutdown guidance

Public technical disclosure

No assigned CVE for this chain

Probing now observed against the N-central service-import XXE surface

A single observed source testing sensitive-file access, traversal and XXE behaviour

No confirmed execution of the complete Able2Shell chain yet

Any one of those points may change quickly.

What Defenders Should Do

If you operate N-central on premises, follow N-able’s current guidance and keep the server offline until the company confirms that it can safely be returned to service.

Teams should also review their exposure and preserve relevant N-central logs.

Given the activity we are now seeing, defenders should pay particular attention to unusual SOAP requests involving N-central’s DMS services and service-import functionality, including:

External XML entities or DOCTYPE declarations

References to remote URLs

Requests for sensitive local files

Unexpected ImportServiceFromFile or related service-import calls

Suspicious ApplianceLogSubmit activity

If those requests are followed by unexpected authentication events, password changes, administrative account creation or JSP requests, that would warrant further investigation.

A match to one of these individual indicators is a lead for investigation, not proof that the full Able2Shell chain succeeded.

We would not recommend waiting for a CVE assignment or CISA KEV entry before acting. The vendor’s own response already indicates how seriously it is treating the issue.

Not Previdian KEV Yet

Despite the new activity, we have not added VULN-2026-0007 to Previdian KEV at this point .

We can confidently say that the N-central service-import XXE surface is now being probed.

If we observe the vulnerability-specific stages of Able2Shell, or obtain other evidence that raises the attribution to high confidence, we will update the record accordingly.

We’ll continue monitoring the disclosure, N-able’s remediation guidance, public exploit development and our own honeypot telemetry for stronger evidence of exploitation.

You can follow the live Previdian record here:

The situation has already moved from public disclosure to real-world probing of the affected attack surface within hours.

If we see the vulnerability-specific stages required to confirm exploitation, the record and this post will be updated as the evidence develops.