N-able pulls hosted N-central after 33 zero-days, PoC published

N-able took its hosted N-central environments offline and urged on-premises MSPs to shut down their servers after researcher Sean Bales published a repository, Able2Shell, containing proof-of-concept exploits for 33 alleged vulnerabilities in the RMM platform. Bales disclosed on November 8 without coordinating with N-able first. On November 10, N-able published seven CVE records and shipped fixes in N-central 2026.4 Hotfix 2. N-central runs privileged agents across every endpoint an MSP manages, so an unauthenticated RCE chain here is a path to every downstream customer. If you self-host N-central, this is an incident, not a patch cycle.

What's affected

The PoC code was tested against N-central 2026.4.0.31; Bales believes most or all of the flaws also affect earlier versions. The seven CVEs N-able published include:

• CVE-2026-125883 — multiple XXE vulnerabilities.
• CVE-2026-125878 — multiple OGNL injection vulnerabilities.
• CVE-2026-125882 — RCE via file-repository upload path traversal (credited to Nate Fair, Sprocket Security).
• CVE-2026-125879 — local privilege escalation to root via a writable syslog-ng config.
• CVE-2026-91000 — local privilege escalation via insecure IPC channels.

Reported severities reach CVSS 9.3. Reporting from BleepingComputer and The Hacker News describes an unauthenticated XXE-to-RCE chain, and the PoC reportedly can create an administrator account.

Exploitation status

N-able says it has observed scanning activity associated with the published PoC code but reports no confirmed exploitation in customer environments. Threat-intel firm Beazley Security states in its advisory that it has seen exploitation attempts; sources differ on whether any succeeded. Censys tracked exposed N-central servers, and Shadowserver reported the count of internet-facing instances falling from 1,338 to roughly 148 as operators pulled them offline. Public PoC plus a mass-managed platform is the combination that turns a disclosure into a race.

Action checklist

1. Hosted N-central: N-able has upgraded all hosted environments. Confirm your tenant is back and patched before resuming use.
2. On-premises N-central: Take the server offline until you have applied 2026.4 Hotfix 2. N-able warned a further hotfix will follow — watch its advisory channel.
3. Do not expose N-central to the internet. Shadowserver's numbers show how many still are. Put the console behind a VPN or management network.
4. Hunt before you trust the patch. The hotfix closes the door; it does not evict an attacker already inside. Review for unexpected administrator accounts, anomalous file-repository uploads, and OGNL/XXE payloads in request logs.
5. Assume downstream exposure if you find indicators: N-central's agents reach managed endpoints, so rotate credentials and review agent-pushed actions across customers.

Context

This is the second N-central zero-day event in a quarter — the platform was exploited in the wild in September (CVE-2026-86218, a pre-auth RCE), following the August authentication-bypass chain (CVE-2026-18556/18577) that CISA added to its KEV catalog. RMM tools are concentrated risk by design: compromise the manager and you inherit every managed estate, which is exactly why ransomware crews prize them. An uncoordinated 33-flaw dump with working PoC is the worst-case disclosure for a platform in that position. Treat any internet-exposed N-central as presumed-probed and work the hunt list above.