On 9 November 2026, N-able took its hosted N-central environments offline in the Americas, Europe and Asia-Pacific, and told customers running N-central on their own servers to take them offline "until further notice". N-central is the remote monitoring and management (RMM) tool that managed service providers use to patch, script and remotely support their clients' computers, so a compromised server can reach every network it manages.
What was published: a GitHub account named Oracle-Security released details and proof-of-concept code, called "Able2Shell", for 33 alleged vulnerabilities: 26 Python scripts, screenshots and a long write-up, according to SecurityOnline. Huntress says the issues form four exploit chains: three lead to remote code execution and one to root. The headline chain starts with an unauthenticated XML External Entity (XXE) flaw and, the researcher claims, ends with code execution and a new administrator account. Testing was done on N-central Appliance 2026.4.0.31, a pre-release build; the researcher says most flaws should also work on earlier versions.
What is confirmed and what isn't: N-able called it a disclosure made without responsible coordination. As of 15:15 UTC on 9 November it said it had not seen active exploitation. It has not confirmed which of the 33 issues are real, and has published no affected or fixed versions, CVE IDs or severity scores. A hotfix is being developed, with no firm date in these reports; Huntress notes the hotfix may not change the displayed version number.
This is separate from earlier N-central problems this year: SecurityOnline says attackers abused CVE-2026-18577 in July and August, and CISA added CVE-2026-86218 to its exploited-vulnerabilities catalog in September. The September hotfix does not protect against Able2Shell.
