N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains

UPDATE: 11/12 @ 6:30 AM ET

New information from N-able changes our guidance from earlier this morning.

N-able has released an active advisory addressing this latest set of exploits. In its advisory, N-able said that the N-central server issue described depends on a non-default configuration, where the Legacy API is turned on and exposed to the public internet. 

N-able released a knowledge base article on how to disable Legacy API settings on on-premises N-central servers. N-able is not advising customers to take N-central offline.

The author of the exploit code has since updated their repository to confirm the exploit only works with Legacy API turned on. Servers running 2026.4 HF2 with Legacy API disabled are not exposed to this exploit chain.

What should you do right now?

• On-premises N-central: confirm that Legacy API is disabled. If it is enabled, follow N-able's article to disable it.

• If you need Legacy API enabled, do not expose it to the internet. Restrict access to the server until N-able provides a fix.

• If you took your server offline based on our earlier update, confirm Legacy API is disabled before bringing it back online.

• Hosted N-central: N-able states that hosted environments are not vulnerable to this issue.

• If Legacy API was enabled and reachable from the internet, review server and endpoint activity from November 11 onward using the indicators in our earlier update below.

We have not yet confirmed whether the Agent2Shell chains affecting Windows Agents and Probes also depend on Legacy API. We are working with N-able to clarify this and will update this post when we know more.

As of this writing, Huntress has not observed exploitation of these issues in our partners' environments. Huntress is continuing to track this incident and will continue updating this blog as new information emerges.

UPDATE: 11/12 @ 1:10 AM ET

Late on November 11, the researcher behind Able2Shell published two more sets of exploit code for N-able N-central, named “4EverAble2Shell” and “Agent2Shell”. Both are stated to work against N-central 2026.4 HF2 (build 2026.4.1.26), the version N-able released on November 10 to address the original disclosure. A fully patched N-central server should be treated as vulnerable. There is no fix available at the time of writing.

Based on our initial review of the published code:

• 4EverAble2Shell is an unauthenticated remote code execution chain that results in root access on the N-central server. It requires no credentials.

• Agent2Shell is a set of more than ten issues in how the N-central server communicates with Windows Agents and Probes. Two of the chains allow an unauthenticated attacker who can reach the server to run commands on managed Windows endpoints, including as SYSTEM.

Used together, these could let an attacker move from an internet-facing N-central server to the endpoints it manages. Huntress is actively investigating, and we will update this post as our analysis continues.

If the POC code is used in an unmodified fashion, the following indicators may appear. Please note that all of these potential indicators were extracted from a static code analysis and none have been observed in the wild:

• In logs to the N-Central Server:

  • POSTs to /dms/services/ServerUI containing jline.internal.TerminalLineSettings (the PoC gets an HTTP 500 back).

  • POSTs to /dms/services/ServerUI containing GenericAgentXMPPMessageExchange with SessionID of -1.

  • POSTs to /dms2/services2/ServerMMS2 containing RemoteExecutionTaskSubmit with sessionID of -1.

• Files on system on the N-Central Server

  • /var/opt/n-central/flag/flag_default.json existing as a symlink to /opt/nable/var/ncsai/scripts/ServerChild.sh.

  • /var/opt/n-central/tmp/serverchild-<12 hex>.bak, .sh or .out.

  • ZIPs under /download/scheduled_tasks/output_files/ containing CodeDropMeta.xml.

• On Windows Endpoints:

  • powershell.exe -NoProfile -NonInteractive -EncodedCommand as SYSTEM, spawned from the N-able Agent.

    • Note: PowerShell is very commonly seen as a child process of N-able, it's the command that is running that is of interest in this case.

  • wsp.exe or service.cfg written to Windows Software Probe\bin, with a backup at CodeDrop\ServiceBackup\wsp.exe and files in Temp\CodeDropTmp.

    • Note: The Windows Software Probe is very commonly seen as a child process of N-able, so that process tree alone is expected, and not a sole indicator of compromise.

  • taskkill /f /im wsp.exe and a stop/start of "Windows Software Probe Service" run from a .cmd in %TEMP%.

What should you do right now?

• On-premises N-central: Take the server offline again, or remove all internet access to it, even if you have applied 2026.4 HF2. Keep it offline until N-able issues guidance for these new issues.

• Do not rely on IP allowlisting alone: The affected endpoints are the same ones Agents and Probes use to check in, so any device on an allowed network can still reach them.

• Hosted N-central: Monitor N-able's status page for guidance. Hosted servers run the same build.

• Review activity from November 11 onward: On the server, look for unexpected administrator accounts, scripts, scheduled tasks, and remote sessions. On Windows endpoints, look for unexpected PowerShell or cmd.exe activity launched by the N-able Agent or Probe, and unexpected restarts of the Windows Software Probe service.

• If you find suspicious activity: Treat it as a potential compromise of your managed environments and engage your incident response team.

UPDATE: 11/10 @ 5:30 PM ET

On November 10, N-able released N-central 2026.4 HF2, (build 2026.4.1.26) to address the Able2Shell vulnerabilities disclosed the day before. According to their release, the critical security update strengthens authentication and permission checks on the server, removes legacy mobile device management (MDM), adds additional validation to file and log handling, and hardens server components and web and sign-in protections. 

The hotfix addresses the following vulnerabilities, which now have designated CVEs: 

• CVE-2026-125883: Multiple XXE vulnerabilities

• CVE-2026-125878: Multiple OGNL injection vulnerabilities

• CVE-2026-125879: Local privilege escalation to root via nable-writable syslog-ng config

• CVE-2026-125880: Stored XSS via MMS3 patch metadata (admin context)

• CVE-2026-125881: Schema-hint SSRF via service import schema validation

• CVE-2026-125882: RCE via file repository upload path traversal (credit to Nate Fair from Sprocket Security)

• CVE-2026-91000: Insecure IPC Channels lead to local privilege escalation

N-able has updated all hosted N-central servers, and all customers running on-premises N-central deployments are advised to upgrade their servers as soon as possible, keeping them offline until the upgrade is complete. Note that all customers, both hosted and on-premises, must also upgrade their Agents and Probes, as the hotfix updates legacy components of the Agent and Probe to change how the two communicate. 

N-able shared on their status page that they had observed "scanning activity associated with the published proof-of-concept code" but no evidence that any customer environment had been successfully exploited. 

As of this writing, Huntress has not observed evidence of Able2Shell exploitation in our partners' environments.

Original post

Acknowledgments: Special thanks to John Hammond, Ben Bernstein, and Andrew Brandt for their contributions to this investigation and writeup.

Huntress is tracking N-able's response to the public disclosure of critical vulnerabilities in its N-central platform, a remote monitoring and management (RMM) platform built for managed service providers and IT teams. On November 9, N-able took its hosted N-central environment offline while it worked to secure the environment and apply remediation. 

That move came after an independent researcher published the details of 33 critical vulnerabilities to GitHub that can be chained to lead to four different exploits (dubbed "Able2Shell"). Three of those chained exploits lead to remote code execution and one leads to privilege escalation to root. The vulnerabilities impact servers running N-central Appliance 2026.4.0.31 (and likely earlier versions as well). 

N-able said it has not seen active exploitation of the vulnerabilities as of November 9 at 15:15:00 UTC. The company is working on a hotfix that it said will be available soon; customers should keep their N-central servers offline until N-able confirms they can be brought back online safely. 

Huntress has tracked and responded to other, separate flaws in N-able's N-central this year, including five critical CVEs:

• August 2026: N-able released a hotfix for CVE-2026-18556, a critical vulnerability impacting all current versions of N-central across both hosted and on‑prem deployments, giving attackers unauthenticated, "god-mode" access to the RMM console. CVE-2026-18577 was disclosed soon after as an incomplete patch to the former CVE.

• September 2026: N-able issued a hotfix to address a third vulnerability, CVE-2026-86218, an actively exploited pre-auth RCE zero day with a 10.0 CVSS score. The next day Huntress produced a proof of concept (PoC) exploit of a separate, net new vulnerability chain (CVE-2026-86206 and CVE-2026-86207) in N-central that allowed attackers to bypass access controls to create unauthorized administrative accounts.

What Should Potentially Impacted Organizations Do? 

Potentially impacted organizations should do the following:

• If you run N-central on premises, take the server offline now and keep it offline until N-able confirms it is safe to restore. 

• If you use N-able's hosted service, expect an outage. N-able has taken its cloud infrastructure offline; follow its status page for updates.  

• Review login and authentication activity from November 8 onward for unexpected or unauthorized access. If you find suspicious activity, involve your incident-response team and assess whether systems or client networks managed through N-central may also be affected. The document warns that exploitation could enable remote code execution or privilege escalation on the server.  

• Carefully examine your audit logs for secondary indicators of compromise. During previous N-central vulnerability exploitations (such as the CVE-2026-86218 zero-day), threat actors were observed "spraying" downstream environments with unauthorized scripts and tools. Specifically, you should monitor for anomalous remote access sessions, new scripts being deployed, or the unauthorized creation of new administrator accounts.

• Apply N-able's hotfix and restore service only when N-able says it is safe. The document said a hotfix was in development, with no exact ETA, so check current vendor guidance rather than relying on this dated update.

  • N-able does not always iterate version numbers when it pushes down live hotfixes that don't require a reboot, so it remains to be seen whether the patched version will be numbered 2026.4.0.31 or something different.

Next Steps

Huntress is actively investigating this incident and we are communicating with our potentially vulnerable customers to share updates as they become available. Please check this blog for further updates as we learn more information.

You can also get further updates from N-able at: https://uptime.n-able.com/event/202561/