N-able released a hotfix for N-central that fixes seven CVEs after a researcher published proof-of-concept code for 33 alleged zero-day vulnerabilities. The researcher says one attack chain needs no credentials.

Key Takeaways

1. Able2Shell is a set of 33 alleged vulnerabilities in N-able N-central, published with proof-of-concept code. The researcher says one chain lets an unauthenticated attacker run commands on the server.
2. Security firms report exploitation attempts against N-central honeypots, but as of November 10, no confirmed compromise of a customer server has been reported.
3. N-able released N-central 2026.4 Hotfix 2 on November 10. It fixes seven CVEs.

Background

Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding Able2Shell, a set of reported zero-day vulnerabilities in N-able N-central.

FAQ

When was Able2Shell first disclosed?

A researcher operating under the GitHub account “Oracle-Security” published a write-up titled “Able2Shell” in the account’s CVEs repository. It describes 33 alleged N-central vulnerabilities with proof-of-concept code. The earliest README commit is dated November 9, 2026 at 04:14 UTC. N-able described the release as a public disclosure by an independent security researcher. N-able does not state whether it was notified in advance and does not name the researcher.

What are the vulnerabilities associated with Able2Shell?

On November 10, N-able published seven CVE records for vulnerabilities fixed in N-central 2026.4 Hotfix 2. On its status page, N-able says the release addresses “the most critical November 9 vulnerabilities” and that a follow-up hotfix will provide further security updates. The page lists all seven as related CVEs. One, CVE-2026-91000, had been reserved on September 14, before the public Able2Shell disclosure.

N-able’s CVE titles match several finding types in the researcher’s README, but N-able has not said which of the 33 findings each CVE addresses. N-able credits CVE-2026-125882 to Nate Fair of Sprocket Security, and a file repository path traversal also appears in the README.

Is Able2Shell one vulnerability or several?

Several. The README lists 33 findings, and some of them are steps in longer exploit chains built from other entries on the same list. The researcher lists four exploit chains. The rest are standalone findings.

The researcher describes the XXE chain as credential-free, and N-able's record for CVE-2026-125883 lists no privileges and no user interaction as required. The researcher’s proof-of-concept takes several identifiers as inputs, and other findings in the README describe anonymous ways to obtain some of them. The XXE step has the appliance fetch a file from an attacker-hosted server.For the MMS3 chains, the researcher says an unauthenticated attacker can plant the script, which runs when a logged-in administrator views the poisoned patch details. N-able’s record for CVE-2026-125880 lists high privileges and active user interaction.

How severe is Able2Shell?

Two of the four chains reach root: MMS3 stored XSS to Audit Export, and SIS path traversal to syslog. The XXE chain runs commands as the nable account (uid 992), and the researcher’s proof-of-concept can also create an administrator account. N-able’s CVSSv4 scores for the seven CVEs range from 8.3 to 9.3, and N-able calls Hotfix 2 a critical security update.

Has N-able confirmed the findings?

N-able has published seven CVEs and a hotfix, but it has not mapped its CVEs to the researcher’s 33 findings or commented on them individually. Before the hotfix, N-able said it was responding to the public disclosure of critical vulnerabilities in N-central by an independent security researcher.

Which versions are affected?

N-able's CVE records list N-central versions before 26.4.1 as affected (the record for CVE-2026-91000 writes this as 2026.4.1), and the fixed build is 2026.4.1.26. The researcher says all testing was done on N-central Appliance 2026.4.0.31, which the researcher describes as a pre-release build, and that "most if not all vulnerabilities should work on previous versions."

Is the hosted N-central service affected?

N-able took its hosted N-central environments offline as a precaution after the disclosure, and its status page lists hosted N-central in the Americas, APAC and Europe among the affected services. On November 10, N-able said all hosted N-central servers across all global regions had been upgraded to the new release. Hosted customers still upgrade their own Agents and Probes.

Has Able2Shell been exploited in the wild?

N-able's status page says it is observing “scanning activity associated with the published proof-of-concept code.” Huntress reported N-able’s statement that it had no evidence that any customer environment had been successfully exploited, and said on November 10 that it had not observed evidence of Able2Shell exploitation in its partners’ environments.

Beazley Security Labs updated its November 9 advisory on November 10 with watchTowr’s report of exploitation attempts against its N-central honeypots. Beazley Security Labs says a confirmed compromise of a customer server “has not been reported.”

Previdian reports exploitation attempts against its N-central decoy environment, not confirmed compromise. Its decoys recorded 68 events from one source IP address starting on November 9, including XXE and sensitive-file access attempts. Previdian says these do not show a completed account takeover or command execution, or a full replay of the published chain.

Which threat actors are exploiting Able2Shell?

As of November 10, there are no details available for any threat actor activity connected to Able2Shell exploitation.

Is there a proof-of-concept (PoC) available?

Yes. The researcher’s README includes Python proof-of-concept code for the alleged vulnerabilities, tested against N-central Appliance 2026.4.0.31.

How does this relate to earlier N-central vulnerabilities?

Able2Shell is a newly disclosed set of vulnerabilities, and it is not known whether any relate to earlier N-central flaws. None of the seven CVEs fixed in Hotfix 2 is in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of November 10. Five earlier N-central CVEs are in the KEV catalog:

Are patches or mitigations available?

Yes. On November 10, N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26), which fixes the seven CVEs above. According to N-able, on-premises customers upgrade their own servers, while N-able upgrades hosted servers. All customers also upgrade their Agents and Probes, Agents first, because an upgraded Probe cannot communicate with Agents that have not been upgraded. Until an on-premises server is upgraded, N-able recommends keeping it offline. A follow-up hotfix with further security updates is also planned. Hotfix 2 removes legacy mobile device management (MDM). The release notes list N-central’s built-in remote control as temporarily disabled, while Take Control continues to work.Are there indicators of compromise?

Yes. Beazley Security Labs and Previdian have published network indicators tied to exploitation attempts, including source IP addresses and the SOAP endpoints targeted. Huntress recommends reviewing login and authentication activity from November 8 onward, and watching for anomalous remote access sessions, newly deployed scripts and unauthorized new administrator accounts.

Has Tenable released product coverage?

A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages:

• CVE-2026-125883
• CVE-2026-125881
• CVE-2026-125878
• CVE-2026-125879
• CVE-2026-125882
• CVE-2026-91000
• CVE-2026-125880

This list may contain plugins released after this blog’s publication.

Has Tenable classified any of these vulnerabilities under Vulnerability Watch?

Yes. Tenable has classified CVE-2026-125883 as a Vulnerability of Interest (VOI) under Vulnerability Watch. CVE-2026-125878, CVE-2026-125881 and CVE-2026-125882 are each classified as a Vulnerability Being Monitored (VBM).

Get more information

• Able2Shell write-up (Oracle-Security on GitHub)
• N-central 2026.4 HF2 Release Notes
• Beazley Security Labs: Emerging Threat: Critical Vulnerabilities in N-able N-central
• Previdian: N-able N-central critical vulnerabilities, what we know so far
• Huntress: N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains
• Field Effect: N-able takes N-central offline as alleged zero-day exploits surface