{"id":"TECH-202611-qnc4tx","kind":"technique","aliases":[],"related":[],"title":"Able2Shell: unpatched N-able N-central zero-days with public XXE-to-RCE exploit code; N-able takes hosted N-central offline and tells on-prem customers to take servers offline","description":null,"summary":"On 9 Nov 2026 a researcher published several zero-day flaws in N-able N-central, the remote monitoring and management (RMM) platform used by MSPs, under the name Able2Shell. The disclosure includes public proof-of-concept code that chains an XXE flaw into remote code execution. watchTowr is reacting to the disclosure and calls it credible. Previdian reports that N-able took its hosted N-central classic environments offline and is advising on-premises customers to take their servers offline. Not confirmed yet: N-able's own advisory, affected versions, CVE IDs, a patch, and whether anyone is exploiting it (unknown). Because N-central can run commands on every managed endpoint, taking over the server gives access to MSP customers' machines. N-central zero-days were exploited before (CVE-2025-8875/8876, Volt Typhoon).","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"N-able N-central","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"You run on-premises N-central, or your MSP manages your machines with N-central (hosted or on-prem). Check whether the N-central server's web interface can be reached from the internet. Look in N-central web/server logs for unusual XML requests to the server or outbound connections from it to unknown hosts, new admin users, and scripts or automation policies pushed to endpoints that you did not schedule. Specific endpoints, IPs and hashes: unknown so far.","fix":"Follow N-able's advice: take on-premises N-central servers offline, or at least off the internet (allow access only through VPN or from trusted IPs), until N-able ships a fix. Install the fix as soon as it is released. If the server was exposed after 9 Nov, treat it as possibly compromised: review admin accounts, API tokens and scripts recently pushed to endpoints, and rotate stored credentials. MSP customers: ask your MSP whether they run N-central and what they have done.","status":"open","published_at":null,"first_seen_at":"2026-11-09T17:50:34+00:00","triaged_at":"2026-11-09T17:50:34+00:00","updated_at":"2026-11-09T17:52:18+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-2025':193B '-202611':40A '-8875':194B '/8876':195B '2026':55B '9':53B 'abl':5A,22A,67B,118B,145B 'able':44A 'able2shell':1A,84B 'access':178B 'advis':130B 'advisori':148B 'affect':149B 'anyon':157B 'call':110B 'central':8A,27A,47A,70B,124B,165B,185B 'chain':95B 'classic':125B 'code':19A,93B,101B 'command':168B 'concept':92B 'confirm':141B 'credibl':112B 'custom':34A,134B,181B 'cve':151B,192B 'day':11A,62B,188B 'disclosur':86B,108B 'earli':49B 'early-warn':48B 'endpoint':172B 'environ':126B 'everi':170B 'execut':102B 'exploit':18A,159B,190B 'flaw':63B,98B 'give':177B 'host':24A,121B 'id':152B 'includ':87B 'machin':182B 'manag':75B,171B 'monitor':73B 'msp':180B 'msps':80B 'n':4A,7A,21A,26A,43A,46A,66B,69B,117B,123B,144B,164B,184B 'n-abl':3A,20A,65B,116B,143B 'n-able':42A 'n-central':6A,25A,45A,68B,122B,163B,183B 'name':83B 'nov':54B 'offlin':28A,38A,127B,139B 'on-prem':31A 'on-premis':131B 'patch':154B 'platform':77B 'prem':33A 'premis':133B 'previdian':113B 'proof':90B 'proof-of-concept':89B 'public':13A,88B 'publish':58B 'qnc4tx':41A 'rce':17A 'react':105B 'remot':72B,100B 'report':114B 'research':57B 'rmm':76B 'run':167B 'server':37A,138B,176B 'sever':59B 'take':23A,36A,136B,173B 'tech':39A 'techniqu':51B 'tell':30A 'took':119B 'typhoon':197B 'unknown':161B 'unpatch':2A 'use':78B 'version':150B 'volt':196B 'warn':50B 'watchtowr':103B 'whether':156B 'xxe':15A,97B 'xxe-to-rc':14A 'yet':142B 'zero':10A,61B,187B 'zero-day':9A,60B,186B","nicknames":["Able2Shell"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["able2shell","nablencentral","ncentral"],"ptokens":["able","central"],"labels":["critical","earlywarning","technique","vendor"],"campaign_type":"exploitation","search_a":"'-202611':40A 'abl':5A,22A 'able':44A 'able2shell':1A 'central':8A,27A,47A 'code':19A 'custom':34A 'day':11A 'exploit':18A 'host':24A 'n':4A,7A,21A,26A,43A,46A 'n-abl':3A,20A 'n-able':42A 'n-central':6A,25A,45A 'offlin':28A,38A 'on-prem':31A 'prem':33A 'public':13A 'qnc4tx':41A 'rce':17A 'server':37A 'take':23A,36A 'tech':39A 'tell':30A 'unpatch':2A 'xxe':15A 'xxe-to-rc':14A 'zero':10A 'zero-day':9A","search_b":"'-2025':193B '-8875':194B '/8876':195B '2026':55B '9':53B 'abl':67B,118B,145B 'able2shell':84B 'access':178B 'advis':130B 'advisori':148B 'affect':149B 'anyon':157B 'call':110B 'central':70B,124B,165B,185B 'chain':95B 'classic':125B 'code':93B,101B 'command':168B 'concept':92B 'confirm':141B 'credibl':112B 'custom':134B,181B 'cve':151B,192B 'day':62B,188B 'disclosur':86B,108B 'earli':49B 'early-warn':48B 'endpoint':172B 'environ':126B 'everi':170B 'execut':102B 'exploit':159B,190B 'flaw':63B,98B 'give':177B 'host':121B 'id':152B 'includ':87B 'machin':182B 'manag':75B,171B 'monitor':73B 'msp':180B 'msps':80B 'n':66B,69B,117B,123B,144B,164B,184B 'n-abl':65B,116B,143B 'n-central':68B,122B,163B,183B 'name':83B 'nov':54B 'offlin':127B,139B 'on-premis':131B 'patch':154B 'platform':77B 'premis':133B 'previdian':113B 'proof':90B 'proof-of-concept':89B 'public':88B 'publish':58B 'react':105B 'remot':72B,100B 'report':114B 'research':57B 'rmm':76B 'run':167B 'server':138B,176B 'sever':59B 'take':136B,173B 'techniqu':51B 'took':119B 'typhoon':197B 'unknown':161B 'use':78B 'version':150B 'volt':196B 'warn':50B 'watchtowr':103B 'whether':156B 'xxe':97B 'yet':142B 'zero':61B,187B 'zero-day':60B,186B","search_c":"","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-qnc4tx","url":"https://x.com/PrevidianCyber/status/2119845511079268860","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-09T17:50:34+00:00","fetched_at":"2026-11-09T17:50:34+00:00","note":null,"cites":["https://x.com/PrevidianCyber/status/2119845511079268860"]}],"documents":[{"id":108629,"url":"https://x.com/watchtowrcyber/status/2119848813372313814","title":"@watchtowrcyber: The watchTowr team is currently rapidly reacting to credible rumors of multiple ","kind":"post","source":"x","publisher":null,"text":"The watchTowr team is currently rapidly reacting to credible rumors of multiple zero-day vulnerabilities impacting N-able N-central, published by a researcher and dubbed \"Able2Shell\".\n\nActive watchTowr Platform clients have been made aware of their exposure. https://t.co/GP8vgOglZZ\n\nlikes 14 reposts 5","published_at":"2026-11-09T17:45:16+00:00","relation":"describes","confidence":null,"note":null},{"id":108628,"url":"https://x.com/watchtowrcyber/status/2119848814597071175","title":"@watchtowrcyber: Is your attack surface exposed to this? Find out with watchTowr: https://t.co/6r","kind":"post","source":"x","publisher":null,"text":"Is your attack surface exposed to this? Find out with watchTowr: https://t.co/6rUOfWaqnp\n\nlikes 0 reposts 0","published_at":"2026-11-09T17:45:16+00:00","relation":"describes","confidence":null,"note":null},{"id":108640,"url":"https://x.com/PrevidianCyber/status/2119845511079268860","title":"Previdian: N-able takes hosted N-central classic offline after critical vulnerability disclosure","kind":"post","source":"analyst","publisher":null,"text":"N-able has taken its hosted N-central classic environments offline following the public disclosure of critical vulnerabilities. On-premises customers are also being advised to take their servers offline. A public XXE-to-RCE proof of concept is available as part of the [disclosure].","published_at":"2026-11-09T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":108715,"url":"https://www.reddit.com/r/netsec/comments/1xrykwg/nable_ncentral_critical_vulnerabilities_what_we/","title":"r/netsec: N-able N-central Critical Vulnerabilities: What We Know So Far","kind":"post","source":"reddit","publisher":null,"text":"N-able N-central Critical Vulnerabilities: What We Know So Far\n\nsubmitted by /u/ethicalhack3r [link] [comments]","published_at":"2026-11-09T17:54:33+00:00","relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}