N-able takes hosted N-central offline after Able2Shell disclosure
Original title: N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains
A researcher posted 33 critical N-central flaws chaining into three RCE paths and one root escalation; N-able reports no exploitation yet.
On November 9, N-able took its hosted N-central environment offline after an independent researcher published details of 33 critical vulnerabilities on GitHub. The flaws, dubbed Able2Shell, can be chained into four exploits affecting N-central Appliance 2026.4.0.31 and likely earlier versions. Three chains lead to remote code execution and one to root privilege escalation. N-able said it had not seen active exploitation as of 15:15 UTC and is preparing a hotfix with no stated ETA.
Unconfirmed: N-able says it had not seen exploitation as of November 9 at 15:15 UTC; impact on earlier versions is described as likely.
- Huntress says customers should keep on-premises N-central servers offline until N-able clears restoration.
- N-able does not always change version numbers for live hotfixes that need no reboot.
- Organizations are told to review authentication activity from November 8 onward.
- A hotfix is in development; the eventual version number is not confirmed.
Impact: Remote code execution or privilege escalation to root
| Product | Affected |
|---|---|
| N-able N-central Appliance | 2026.4.0.31 and likely earlier |
- 1.Take on-premises N-central servers offline until N-able confirms restoration is safe.
- 2.Review login and authentication activity from November 8 for unauthorized access.
- 3.Apply the hotfix and restore service only when N-able says it is safe.
- Vendors
- N-able
- Products
- N-central Appliance
- Organizations
- Huntress
From the original article
6 min read at huntress.comN-able took N-central offline after 33 critical flaws were disclosed, including chains enabling remote code execution and privilege escalation.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.