Able2Shell: unpatched N-able N-central zero-days with public XXE-to-RCE exploit code; N-able takes hosted N-central offline and tells on-prem customers to take servers offline

On 9 Nov 2026 a researcher published several zero-day flaws in N-able N-central, the remote monitoring and management (RMM) platform used by MSPs, under the name Able2Shell. The disclosure includes public proof-of-concept code that chains an XXE flaw into remote code execution. watchTowr is reacting to the disclosure and calls it credible. Previdian reports that N-able took its hosted N-central classic environments offline and is advising on-premises customers to take their servers offline. Not confirmed yet: N-able's own advisory, affected versions, CVE IDs, a patch, and whether anyone is exploiting it (unknown). Because N-central can run commands on every managed endpoint, taking over the server gives access to MSP customers' machines. N-central zero-days were exploited before (CVE-2025-8875/8876, Volt Typhoon).