Back Huntress

N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains

Huntress • November 9, 2026

Acknowledgments : Special thanks to John Hammond, Ben Bernstein, and Andrew Brandt for their contributions to this investigation and writeup.

Huntress is tracking N-able's response to the public disclosure of critical vulnerabilities in its N-central platform, a remote monitoring and management (RMM) platform built for managed service providers and IT teams. On November 9, N-able took its hosted N-central environment offline while it worked to secure the environment and apply remediation.

That move came after an independent researcher published the details of 33 critical vulnerabilities to GitHub that can be chained to lead to four different exploits (dubbed "Able2Shell"). Three of those chained exploits lead to remote code execution and one leads to privilege escalation to root. The vulnerabilities impact servers running N-central Appliance 2026.4.0.31 (and likely earlier versions as well).

N-able said it has not seen active exploitation of the vulnerabilities as of November 9 at 15:15:00 UTC. The company is working on a hotfix that it said will be available soon; customers should keep their N-central servers offline until N-able confirms they can be brought back online safely.

Huntress has tracked and responded to other, separate flaws in N-able's N-central this year, including five critical CVEs :

August 2026: N-able released a hotfix for CVE-2026-18556 , a critical vulnerability impacting all current versions of N-central across both hosted and on‑prem deployments, giving attackers unauthenticated, "god-mode" access to the RMM console. CVE-2026-18577 was disclosed soon after as an incomplete patch to the former CVE.

September 2026: N-able issued a hotfix to address a third vulnerability, CVE-2026-86218 , an actively exploited pre-auth RCE zero day with a 10.0 CVSS score. The day Huntress produced a proof of concept (PoC) exploit of a separate, net new vulnerability chain ( CVE-2026-86206 and CVE-2026-86207 ) in N-central that allowed attackers to bypass access controls to create unauthorized administrative accounts.

What Should Potentially Impacted Organizations Do?

Potentially impacted organizations should do the following:

If you run N-central on premises, take the server offline now and keep it offline until N-able confirms it is safe to restore.

If you use N-able's hosted service, expect an outage. N-able has taken its cloud infrastructure offline; follow its status page for updates.

Review login and authentication activity from November 8 onward for unexpected or unauthorized access. If you find suspicious activity, involve your incident-response team and assess whether systems or client networks managed through N-central may also be affected. The document warns that exploitation could enable remote code execution or privilege escalation on the server.

Carefully examine your audit logs for secondary indicators of compromise. During N-central vulnerability exploitations (such as the CVE-2026-86218 zero-day), threat actors were observed "spraying" downstream environments with unauthorized scripts and tools. Specifically, you should monitor for anomalous remote access sessions, new scripts being deployed, or the unauthorized creation of new administrator accounts.

Apply N-able's hotfix and restore service only when N-able says it is safe. The document said a hotfix was in development, with no exact ETA, so check current vendor guidance rather than relying on this dated update. N-able does not always iterate version numbers when it pushes down live hotfixes that don't require a reboot, so it remains to be seen whether the patched version will be numbered 2026.4.0.31 or something different.

N-able does not always iterate version numbers when it pushes down live hotfixes that don't require a reboot, so it remains to be seen whether the patched version will be numbered 2026.4.0.31 or something different.

You can also get further updates from N-able at:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

N-able N-central Offline After 33 Zero-Day Vulnerabilities Disclosed On November 8-9, 2026, security researcher Sean Bales disclosed over 30 zero-day vulnerabilities in N-able's N-central platform, publishing proof-of-concept (PoC) exploits in a GitHub repository called Able2Shell. The vulnerabilities include unauthenticated XML External Entity (XXE) injection and remote code execution (RCE) flaws, which could allow attackers to hijack sessions, create rogue administrator accounts, and gain full control over managed environments. In response, N-able took its hosted N-central services offline globally and advised on-premises customers to do the same. As of November 10, N-able reported no confirmed active exploitation of the vulnerabilities but is working on a hotfix expected to be released the same day. The vulnerabilities could have significant impacts on managed service providers (MSPs) using the platform, as compromising a single instance could lead to widespread access across multiple client environments. 16 sources 72

Extracted Entities

N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains

The full story

Extracted Entities

Attack Types (1)

CVEs (5)

Platforms (1)

Tools (1)

Vulnerabilities (1)