---
id: "TECH-202611-qnc4tx"
page: "https://infrastack.ai/live/TECH-202611-qnc4tx"
kind: "technique"
aliases: []
title: "Able2Shell: unpatched N-able N-central zero-days with public XXE-to-RCE exploit code; N-able takes hosted N-central offline and tells on-prem customers to take servers offline"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "N-able N-central", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-09T17:50:34+00:00"
updated_at: "2026-11-09T17:52:18+00:00"
sources: [{"source": "analyst", "url": "https://x.com/PrevidianCyber/status/2119845511079268860", "first_seen_at": "2026-11-09T17:50:34+00:00", "cites": ["https://x.com/PrevidianCyber/status/2119845511079268860"]}]
exploit_sources: []
---

# Able2Shell: unpatched N-able N-central zero-days with public XXE-to-RCE exploit code; N-able takes hosted N-central offline and tells on-prem customers to take servers offline

Link for people: https://infrastack.ai/live/TECH-202611-qnc4tx (this .md is for agents)

On 9 Nov 2026 a researcher published several zero-day flaws in N-able N-central, the remote monitoring and management (RMM) platform used by MSPs, under the name Able2Shell. The disclosure includes public proof-of-concept code that chains an XXE flaw into remote code execution. watchTowr is reacting to the disclosure and calls it credible. Previdian reports that N-able took its hosted N-central classic environments offline and is advising on-premises customers to take their servers offline. Not confirmed yet: N-able's own advisory, affected versions, CVE IDs, a patch, and whether anyone is exploiting it (unknown). Because N-central can run commands on every managed endpoint, taking over the server gives access to MSP customers' machines. N-central zero-days were exploited before (CVE-2025-8875/8876, Volt Typhoon).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:N-able N-central affected unknown fixed no fixed version listed

## How to check

You run on-premises N-central, or your MSP manages your machines with N-central (hosted or on-prem). Check whether the N-central server's web interface can be reached from the internet. Look in N-central web/server logs for unusual XML requests to the server or outbound connections from it to unknown hosts, new admin users, and scripts or automation policies pushed to endpoints that you did not schedule. Specific endpoints, IPs and hashes: unknown so far.

## Fix

Follow N-able's advice: take on-premises N-central servers offline, or at least off the internet (allow access only through VPN or from trusted IPs), until N-able ships a fix. Install the fix as soon as it is released. If the server was exposed after 9 Nov, treat it as possibly compromised: review admin accounts, API tokens and scripts recently pushed to endpoints, and rotate stored credentials. MSP customers: ask your MSP whether they run N-central and what they have done.

## Timeline

- 2026-11-09T17:50:34+00:00 analyst https://x.com/PrevidianCyber/status/2119845511079268860

## Documents

- [describes] @watchtowrcyber: The watchTowr team is currently rapidly reacting to credible rumors of multiple  https://x.com/watchtowrcyber/status/2119848813372313814
- [describes] @watchtowrcyber: Is your attack surface exposed to this? Find out with watchTowr: https://t.co/6r https://x.com/watchtowrcyber/status/2119848814597071175
- [describes] Previdian: N-able takes hosted N-central classic offline after critical vulnerability disclosure https://x.com/PrevidianCyber/status/2119845511079268860
- [discussion] r/netsec: N-able N-central Critical Vulnerabilities: What We Know So Far https://www.reddit.com/r/netsec/comments/1xrykwg/nable_ncentral_critical_vulnerabilities_what_we/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_