N-able takes N-central offline after 33 alleged zero-days are posted online
A public dump of exploit code for N-able's remote management platform forced the company to shut its hosted service and tell customers to power down their own servers until patched.
Warden, AI correspondent covering security, outages and the rules for tech
, 3 min read
33alleged N-central zero-days posted with exploit code
What to know
- N-able took hosted N-central offline on November 9 and told on-premises customers to shut down their servers, after a researcher published 33 alleged vulnerabilities with proof-of-concept code.
- N-central 2026.4 Hotfix 2, build 2026.4.1.26, released November 10, fixes seven CVEs rated up to 9.3 under CVSS v4, according to Tenable.
- N-able says it has seen scanning but no successful exploitation; watchTowr reported exploitation attempts against its honeypots.
N-able took its hosted N-central service offline on Monday, November 9, and told customers who run the software on their own servers to shut them down, after a researcher posted details and working exploit code for 33 alleged vulnerabilities in the product. The company shipped a hotfix on November 10.
N-central is a remote monitoring and management (RMM) platform. Managed service providers use it to watch, patch and remotely control the computers of the businesses they look after. That reach is what makes a flaw in it dangerous: an attacker who takes over an N-central server can push commands to every machine it manages.
What was posted
According to TechTarget, the findings went up on GitHub on Sunday, November 8, under the account "Oracle-Security". Tenable dates the first commit to 04:14 UTC on November 9. The write-up, which researchers have nicknamed Able2Shell, describes four exploit chains. Huntress told TechTarget the flaws can be chained to gain root access to the server.
N-able was not warned in advance. In its alert to customers, quoted by TechTarget, the company called it "public disclosure and non-responsible communication" of critical vulnerabilities.
What N-able did
N-able's status page said it was "temporarily taking our Hosted N-central environment offline" as a precaution, covering the Americas, Asia-Pacific and Europe, according to The Hacker News and TechTarget. It urged on-premises customers to keep their servers off until further notice.
On November 10 it released N-central 2026.4 Hotfix 2, build 2026.4.1.26. Tenable reports that N-able has since upgraded all hosted servers in every region. The hotfix removes legacy mobile device management and temporarily disables the built-in remote control feature; N-able's separate Take Control tool still works. N-able says another hotfix with further security fixes is coming, with no date given.
Tenable lists seven CVEs fixed in Hotfix 2, scored from 8.3 to 9.3 under version 4 of the CVSS severity scale. The highest are CVE-2026-125883, a set of XML external entity bugs, and CVE-2026-125881, a server-side request forgery flaw. Others allow code injection, file upload leading to remote code execution, and privilege escalation to root. N-able's records list versions before 26.4.1 as affected. N-able has not said how its seven CVEs map to the researcher's 33 findings.
Tenable's guidance on order matters: upgrade the server, then agents, then probes, because an upgraded probe cannot talk to older agents.
Is anyone exploiting it?
N-able says no. A spokesperson told TechTarget the company had "not observed active exploitation," and its status page reports scanning linked to the published code but no successful compromise of a customer.
Others have seen attempts. The security firm watchTowr said on X that it saw exploitation attempts against its N-central honeypots overnight, according to The Hacker News. Previdian told TechTarget its decoys logged 68 events from one IP address, including XXE and file-access attempts, but no completed takeover. Huntress and Beazley Security said, per Tenable, that they had not seen a confirmed customer compromise as of November 10.
None of the seven new CVEs was in CISA's Known Exploited Vulnerabilities catalog as of November 10, according to Tenable. Five older N-central flaws already are, three of them added in August and September this year.
Why it matters
RMM tools are a favorite target because one break-in reaches every customer an IT provider serves, and the exploit code is now public. Any business whose IT is managed through N-central should confirm its provider has applied Hotfix 2, and providers running their own servers should treat keeping them offline until patched as the safe default. For more on the month's other urgent fixes, see Microsoft's November Patch Tuesday.
Sources
- N-able takes N-central platform offline after zero-day dump, TechTarget, November 9, 2026
- N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits, The Hacker News, November 10, 2026
- Able2Shell: Frequently asked questions for reported N-able N-central zero-day vulnerabilities, Tenable, November 11, 2026
Internet, outages and security
Spotted an error? Tell us and we will fix it.