N-able Takes N-central Offline After 33 Flaws Disclosed
Summary
N-able took hosted N-central environments offline and advised on-premises users to shut down after 33 flaws and public exploits were disclosed. A hotfix addresses seven CVEs; N-able reported scanning but no observed exploitation.
Key points
- Researcher Sean Bales disclosed 33 flaws, collectively called Able2Shell, and published exploits; some flaws reportedly form longer exploit chains.
- N-able took hosted N-central environments offline across the Americas, Europe, and Asia-Pacific, and advised on-premises customers to shut down their servers.
- Hotfix 2 for N-central 2026.4 addresses seven CVEs, including flaws involving XXE, OGNL injection, privilege escalation, stored XSS, schema validation, and file-upload path traversal leading to RCE.
- Tenable described an unauthenticated XXE chain that could lead to compromise of a central IT management system.
- N-able reported that attackers were scanning for vulnerable systems, but said it had not observed exploitation of these newly disclosed flaws.
- Organizations were advised to apply the hotfix where appropriate, preserve logs, review authentication and administration activity, and investigate suspicious sessions or script deployments.
Article Details
- Vulnerability Types
- XML external entity (XXE)
- OGNL injection
- Local privilege escalation
- Stored cross-site scripting (XSS)
- Schema validation flaw
- File repository upload path traversal leading to remote code execution
- Insecure IPC channels
- Authentication bypass
- Exploitation Status
- not_reported
- Exploit Availability
- public_exploit
- Patch Status
- partial
- Workarounds
- Apply N-central 2026.4 Hotfix 2 (build 2026.4.1.26).
- Keep on-premises N-central offline until N-able provides safe restoration instructions.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe disclosed flaws can allow attackers to execute commands on the underlying N-central server.T1068 · Exploitation for Privilege EscalationThe article describes local privilege-escalation flaws that can raise access to root.T1136 · Create AccountThe article says the disclosed exploits can be used to create administrator accounts.
CVE
CVE-2025-8875N-able · N-centralwith a significant security incident. In August 2025, CISA added two N-central vulnerabilities, CVE-2025-8875 and CVE-2025-8876, to its Known Exploited Vulnerabilities catalog after they were exploited in theCVE-2025-8876N-able · N-centralsecurity incident. In August 2025, CISA added two N-central vulnerabilities, CVE-2025-8875 and CVE-2025-8876, to its Known Exploited Vulnerabilities catalog after they were exploited in the wild.CVE-2026-125878N-able · N-centralhotfix are tracked as the following: CVE-2026-125883, which covers multiple XXE vulnerabilities; CVE-2026-125878, which covers multiple OGNL Injection vulnerabilities; CVE-2026-125879, a local privilege escalationCVE-2026-125879N-able · N-centralmultiple XXE vulnerabilities; CVE-2026-125878, which covers multiple OGNL Injection vulnerabilities; CVE-2026-125879, a local privilege escalation flaw; CVE-2026-125880, described as stored XSS via MMS3 patch metadata;CVE-2026-125880N-able · N-centralcovers multiple OGNL Injection vulnerabilities; CVE-2026-125879, a local privilege escalation flaw; CVE-2026-125880, described as stored XSS via MMS3 patch metadata; and CVE-2026-125881, a schema validation flaw.CVE-2026-125881N-able · N-centralprivilege escalation flaw; CVE-2026-125880, described as stored XSS via MMS3 patch metadata; and CVE-2026-125881, a schema validation flaw.CVE-2026-125882N-able · N-centralThe patch also addresses CVE-2026-125882, which enables remote code execution (RCE) via file repository upload path traversal and was discovered by Nate Fair of Sprocket Security; and CVE-2026-91000, which leads toCVE-2026-125883N-able · N-centralFlaws covered by the N-able hotfix are tracked as the following: CVE-2026-125883, which covers multiple XXE vulnerabilities; CVE-2026-125878, which covers multiple OGNL Injection vulnerabilities; CVE-2026-125879, aCVE-2026-18556N-able · N-centralMore recently, in August 2026, attackers exploited an authentication-bypass flaw (CVE-2026-18556), subsequently finding a way around N-able's initial fix through a related vulnerability, CVE-2026-18577. The secondCVE-2026-18577N-able · N-centralsubsequently finding a way around N-able's initial fix through a related vulnerability, CVE-2026-18577. The second incident allowed attackers to gain administrative access to vulnerable N-central serversCVE-2026-91000N-able · N-centralvia file repository upload path traversal and was discovered by Nate Fair of Sprocket Security; and CVE-2026-91000, which leads to local privilege escalation via insecure IPC Channels.
People
Gene MoodyThe Action1 field CTO commented on the risks of RMM platforms and recommended mitigation steps for affected organizations.Nate FairThe article credits him with discovering CVE-2026-125882, the path-traversal flaw enabling remote code execution.Sean BalesThe offensive security researcher publicly disclosed the Able2Shell flaws and published exploits for them.
Vendors
Products
Industries
Endpoint managementThe extraordinary scenario has major repercussions for the entire endpoint management industry, including managed service providers (MSPs) and IT managers that broadly use N-central to monitor, manage, and secureManaged service providersscenario has major repercussions for the entire endpoint management industry, including managed service providers (MSPs) and IT managers that broadly use N-central to monitor, manage, and secure customer