N-able Takes N-central Cloud Services Offline After Able2Shell Disclosure
Summary
After disclosure of 33 critical N-central vulnerabilities, N-able took hosted services offline. The flaws can enable remote code execution or root privilege escalation; N-able reported no active exploitation and said a hotfix was in development.
Key points
- An independent researcher disclosed 33 critical vulnerabilities affecting N-central Appliance 2026.4.0.31 and likely earlier versions.
- The vulnerabilities can be chained into four exploits: three leading to remote code execution and one to root privilege escalation.
- N-able took its hosted N-central environment offline while working on remediation.
- N-able said it had not seen active exploitation as of November 9, 2026, at 15:15 UTC.
- A hotfix was in development, with no exact release time; N-able advised customers to keep N-central servers offline until it confirms they are safe to restore.
- The article advises reviewing authentication and audit logs for suspicious access, anomalous remote sessions, unauthorized scripts, and newly created administrator accounts.
Article Details
- Vulnerability Types
- Remote code execution
- Privilege escalation
- Severity
- Critical
- Affected Versions
- N-central Appliance 2026.4.0.31
- Earlier N-central versions (likely, but not confirmed)
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Keep on-premises N-central servers offline until N-able confirms they can be safely restored.
CVE
CVE-2026-18556N-able · N-centralAugust 2026: N-able released a hotfix for CVE-2026-18556, a critical vulnerability impacting all current versions of N-central across both hosted and on‑prem deployments, giving attackers unauthenticated, "god-mode"CVE-2026-18577N-able · N-centraland on‑prem deployments, giving attackers unauthenticated, "god-mode" access to the RMM console. CVE-2026-18577 was disclosed soon after as an incomplete patch to the former CVE.CVE-2026-86206N-able · N-centralday Huntress produced a proof of concept (PoC) exploit of a separate, net new vulnerability chain (CVE-2026-86206 and CVE-2026-86207) in N-central that allowed attackers to bypass access controls to createCVE-2026-86207N-able · N-centrala proof of concept (PoC) exploit of a separate, net new vulnerability chain (CVE-2026-86206 and CVE-2026-86207) in N-central that allowed attackers to bypass access controls to create unauthorized administrativeCVE-2026-86218N-able · N-centralSeptember 2026: N-able issued a hotfix to address a third vulnerability, CVE-2026-86218, an actively exploited pre-auth RCE zero day with a 10.0 CVSS score.