N-able takes N-central offline after disclosure of 33 flaws

Rapid7 reports that on 9 November 2026, N-able disclosed that it was responding to public details about critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform. The disclosure, attributed to an independent researcher under the name Able2Shell, describes 33 issues with capabilities including unauthenticated remote code execution, privilege escalation to root, credential disclosure, and unauthorised account creation.

One chain apparently combines XML external entity (XXE) and session-handling weaknesses to run code as the nable service account. Rapid7 Intelligence is currently triaging the published details, and N-able has noted ongoing analysis.

As of 10 November 2026, N-able stated it had scanned activity tied to the PoC code but found no evidence that any customer environments had been successfully exploited. The vendor advised keeping N-central deployments offline while it develops and validates a hotfix; hosted N-central classic environments were also reported offline. The incident notice does not yet include CVE identifiers or CVSS scores.

N-central is used by managed service providers and enterprise IT teams to administer endpoints and infrastructure, so compromise of an RMM server can threaten downstream managed environments. The platform has seen prior targeting, including an authentication bypass covered by Rapid7 in August 2026. Rapid7 emphasises treating the current disclosure as urgent and urges careful monitoring and adherence to the vendor’s incident notice. Affected version details are limited; Rapid7 notes testing of N-central Appliance 2026.4.0.31, with no full remediation build identified in the notice.