N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell.
"As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the environment and implement appropriate remediation," N-able said.
"During this time, customers will be unable to access their Hosted N-central classic environment, and associated services may be unavailable. However, the Ecoverse services under N-able Login remain available and online, including Asset View, Patching, Vulnerability Management, scripting, policies and tagging."
The company also said it has not observed any signs of active exploitation of these vulnerabilities, adding it's currently working on a hot fix to address them.
The following services are impacted -
- N-central (hosted version) (Americas)
- N-central (hosted version) (APAC)
- N-central (hosted version) (Europe)
- N-central On-premise (Americas)
- N-central On-premise (APAC)
- N-central On-premise (Europe)
The development comes as independent security researcher Sean Bales disclosed multiple security flaws along with proof-of-concept (PoC) exploits. The researcher said the issues were tested against N-able N-central Appliance 2026.4.0.31.
The identified zero-day vulnerabilities include credential disclosure, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity (XXE) injection, and remote code execution (RCE) flaws -
- Multiple N-central zero-days enable anonymous credential theft, administrator creation, and nable/root RCE.
- Chains include XXE/NCI trust abuse, support-token theft, unsigned NSP execution, XSS-to-OGNL, and authenticated reverse shells.
- Arbitrary file writes, traversal, credential disclosure, MDM impersonation, audit tampering, and privileged-helper injection.
- A native GenericTCP stack overflow also achieves root command execution
Successful exploitation of these flaws can allow rogue administrative access to the N-central management interface and facilitate command execution as root.
Update
watchTowr, in a post shared on X, said it "observed exploitation attempts against N-able N-central honeypots overnight following the 'Able2Shell' zero-days being dropped."
The preemptive exposure management firm is urging users to audit for signs of compromise, restrict access, and follow vendor guidance on mitigation steps.
In an X post, Defused Cyber said it has detected probing of N-able N-central for the Able2Shell zero-days. "We have seen opening of anonymous agent sessions, pulling appliance config and hitting the remote control endpoint without auth," it added. "These pathways are part of the 0-day exploit surface."
N-able has also confirmed that it's seeing "scanning activity associated with the published proof-of-concept code" but emphasized there is no evidence of successful exploitation in any customer environment.
The company has released N-central 2026.4 HF2 to address the following vulnerabilities. A follow-up hotfix is expected to be released to "provide further security updates" as part of its response to the Able2Shell disclosure.
- CVE-2026-125883 - Multiple XXE Vulnerabilities
- CVE-2026-125878 - Multiple OGNL Injection vulnerabilities
- CVE-2026-125879 - Local privilege escalation to root via nable-writable syslog-ng config
- CVE-2026-125880 - Stored XSS via MMS3 patch metadata (admin context)
- CVE-2026-125881 - Schema-hint SSRF via service import schema validation
- CVE-2026-125882 - RCE via file repository upload path traversal (Credit Nate Fair, Sprocket Security)
- CVE-2026-91000 - Insecure IPC Channels lead to local privilege escalation
All Hosted N-central servers (NCODs) across all global regions have been upgraded. N-able is also urging customers to keep N-central servers offline until the updates have been successfully applied.
According to data from Censys, there are 1,728 internet-exposed N-central instances. Threat intelligence firm Previdian said it has recorded 68 exploitation attempts against one of its honeypots from a single IP address within about 18 hours of the publication.
Huntress is urging users to review login and authentication activity from November 8, 2026, onward for unexpected or unauthorized access, examine audit logs for secondary indicators of compromise, and apply N-able's hotfix and restore service only when N-able says it is safe.
