N-able Pulls N-central Cloud Offline After Researcher Publishes 33 Critical Flaws

On November 9, N-able took its hosted N-central environment offline after an independent researcher published details of 33 critical vulnerabilities to GitHub. N-central is a remote monitoring and management (RMM) platform used by managed service providers and IT teams. The flaws can be combined into four exploit chains, dubbed "Able2Shell". Three of the chains lead to remote code execution, and one leads to privilege escalation to root. The affected version is N-central Appliance 2026.4.0.31, and earlier versions are likely affected too.

N-able said it had not seen active exploitation as of November 9 at 15:15:00 UTC. The company is working on a hotfix that it expects to release soon. In the meantime, customers should keep their N-central servers offline until N-able confirms it is safe to bring them back online. Customers running on-premises N-central servers should also take them offline temporarily until further notice.

Huntress is tracking N-able's response to the disclosure. It noted that it has also tracked and responded to other, separate flaws in N-central this year, including five critical CVEs. For businesses that rely on an IT provider, an RMM platform is a high-value target because it sits at the centre of how devices are managed.