N-able N-central Vulnerability: Able2Shell Attack Code Posted for 33 Alleged Flaws, Seven CVEs Fixed in 2026.4 Hotfix 2, and What to Check This Week

A researcher has published attack code for 33 alleged flaws in N-able N-central, the remote monitoring and management (RMM) tool many IT providers use to run their clients' computers and servers. One of the attack chains needs no login. If your company or your IT provider uses N-central, that server can send commands to every machine it manages, so N-central 2026.4 Hotfix 2 (build 2026.4.1.26) needs to be installed this week.

N-able released the hotfix on November 10, 2026, and it fixes seven CVEs. As of N-able's latest statements, nobody has confirmed that a customer was actually hacked this way. N-able has reported scanning activity linked to the published code.

What happened with N-able N-central (Able2Shell)

The researcher's write-up, titled "Able2Shell", was posted on GitHub under the account "Oracle-Security". Tenable reports that the write-up's earliest commit is dated November 9, 2026. It lists 33 vulnerabilities and four exploit chains. The researcher says they tested on "N-able N-central Appliance 2026.4.0.31", which they describe as a pre-release build. They say that when they posted, all the vulnerabilities worked on that version and none were patched. They also expect most to work on older versions.

The write-up does not say whether N-able was warned in advance.

According to Huntress, N-able took its hosted N-central service offline on November 9 as a precaution. On November 10, N-able published the 2026.4 Hotfix 2 release notes and said all hosted servers had been upgraded and brought back online.

What is confirmed and what is only claimed

Tenable also reports that N-able plans another hotfix with more security updates. Watch for it.

The seven N-central CVEs fixed in Hotfix 2

N-able's release notes list these as fixed. N-able's page gives no CVSS scores. The scores below are the CVSS v4 figures Tenable lists.

The record for CVE-2026-125883 says it affects N-central versions before 26.4.1.

How the N-central attack chains work

The researcher describes four chains:

1. No login needed: an XXE flaw in the service import feature lets an anonymous attacker run commands as the nable service account. The researcher says this chain can also create an enabled Default Administrator account.
2. Starts without a login, needs an admin: an attacker plants a script in patch details. When a ProductAdmin opens that patch detail, the attacker gets command execution.
3. Starts without a login, ends at root: a similar planted script, run when an administrator views it, uses the audit export feature to reach root.
4. Needs a login: a path traversal flaw plus a syslog installer helper lets a logged-in user climb from nable to root.

In plain terms, anyone who can reach the server's web interface may be able to take it over without a password.

Why it matters for a company network

An RMM server holds the keys to every computer it manages. It pushes scripts, installs software and opens remote sessions. Huntress notes that in past N-central attacks, the attackers pushed unauthorized scripts and tools into the networks the server managed.

If your business uses a managed IT provider, you may never see N-central yourself. The agent on your office computers and servers still takes orders from it. A breach of your provider's server can become a breach of your network.

What to do this week

It is also worth checking whether your management server's web interface can be reached from the open internet. If it can be, limiting who can reach it shrinks the risk from flaws like these.

N-able N-central questions people are asking

What is Able2Shell?

Able2Shell is the name a researcher gave to a set of 33 alleged vulnerabilities in N-able N-central, published with proof-of-concept code. The flaws can be chained into four attacks, and one of those chains needs no login.

Is the N-central vulnerability being exploited?

N-able reported scanning tied to the published code. A successful customer compromise has not been confirmed, and as of November 10, CISA had not listed any of the seven CVEs as exploited.

Which N-central version fixes Able2Shell?

N-central 2026.4 Hotfix 2, build 2026.4.1.26, released November 10, 2026. It fixes seven CVEs. N-able has not said whether those cover all 33 findings.

I use hosted N-central (N-central cloud). Do I need to do anything?

Yes. N-able upgraded the hosted servers, but you still need to upgrade your Agents and Probes, Agents first.

Why is N-central remote control not working after the update?

Hotfix 2 temporarily disables built-in remote control. N-able says it will come back in a future fix. Take Control still works.

My IT company manages our computers. Are we affected?

Only if your provider uses N-central. Ask them directly, and ask for the build number and whether they reviewed logs from November 8 onward.

The bigger lesson

The tools that manage your systems need the same patching and review as the systems themselves, because whoever controls the management server controls everything it touches. Know which RMM tool touches your network, who keeps it updated, and how fast they act when a flaw like this is published.

See how we approach this at security hardening, or get a quote for a review of your setup.

Get security alerts like this by email, plus our free checklist, at security alerts.

Sources: N-able N-central 2026.4 HF2 release notes; Able2Shell researcher write-up; Huntress; Tenable; Tenable CVE-2026-125883.