Cyber security firm N-Able has taken the extraordinary step of shutting down its hosted N-central environments across North and South America, Europe, and the Asia-Pacific after an independent security researcher disclosed 33 vulnerabilities in the remote monitoring and management platform.
The researcher, Sean Bales, found several glaring vulnerabilities, including unauthenticated remote code execution, privilege escalation to root, credential disclosure, and unauthorised account creation issues. Bales has dubbed the pool of vulnerabilities Able2Shell.
Unfortunately, hackers appear to be already weaponising proof-of-concept code, leading N-Able to recommend that its customers also take their own N-central environments offline until upgrades can be performed.
“N-able is currently responding to the public disclosure of critical vulnerabilities in N-central by an independent security researcher,” the company said in a Critical Security Incident update.
“We are now observing scanning activity associated with the published proof-of-concept code. We continue to recommend that N-central servers remain offline until your server has been successfully upgraded.”
N-Able has released a hotfix, N-central 2026.4 HF2, with another hotfix in the pipeline to “provide further security updates as part of our ongoing response to the disclosure.”
The current hotfix addresses the following CVEs:
- CVE-2026-125883 - Multiple XXE Vulnerabilities
- CVE-2026-125878 - Multiple OGNL Injection vulnerabilities
- CVE-2026-125879 - Local privilege escalation to root via nable-writable syslog-ng config
- CVE-2026-125880 - Stored XSS via MMS3 patch metadata (admin context)
- CVE-2026-125881 - Schema-hint SSRF via service import schema validation
- CVE-2026-125882 - RCE via file repository upload path traversal (Credit Nate Fair, Sprocket Security)
- CVE-2026-91000 - Insecure IPC Channels lead to local privilege escalation
Fellow cyber security firm Rapid7 breaks down how some of the vulnerabilities can be chained together.
“One unauthenticated chain combines XML external entity (XXE) and session-handling weaknesses to execute code as the nable service account,” the company said in a November 10 blog post.
“Other demonstrated chains involve an administrator viewing malicious patch metadata or use ProductAdmin credentials. Rapid7 Intelligence is currently triaging the newly published details.”
N-Central is popular with many managed service providers and IT teams for endpoint management; compromise can easily impact downstream environments.
“Given the platform's administrative reach and the availability of public exploit code, Rapid7 recommends treating the current disclosure as an emergency,” the company said.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
