N-able N-central Able2Shell
N-able N-central Able2Shell: hotfix 2026.4.1.26 is out; on-premises servers stay exposed until they run it, and Agents and Probes need upgrading too
Reachable if an on-premises N-central server below build 2026.4.1.26 is online and an attacker can reach its web interfaces over the network, because some of the published flaws need no login (CCB Belgium, Rapid7)
N-able released the fix on November 10, N-central 2026.4 HF2 (build 2026.4.1.26), and an on-premises server stays exposed until it runs that build. Able2Shell is the name a researcher gave to 33 issues in N-able N-central, the remote monitoring and management (RMM) server that MSPs and IT teams use to manage endpoints. The researcher published details and proof-of-concept code, and CCB Belgium notes that some of the issues need no login.
N-able upgrades hosted servers itself. On-premises customers must upgrade their own servers, and all customers, hosted and on-premises, must then upgrade their Agents and Probes, Agents first. N-able's release notes list seven CVEs fixed in HF2 (CVE-2026-125878 through CVE-2026-125883 and CVE-2026-91000), without CVSS scores. The notes do not use the Able2Shell name, and one CVE is credited to a different researcher, so we have not matched each CVE to a specific Able2Shell issue. N-able reports scanning activity tied to the published code and says it has no evidence that any customer environment has been successfully exploited. None of the seven CVEs is on CISA's KEV. CCB Belgium explains why the server matters. "Whoever takes over the N-central server controls every device it manages, including clients' networks."
Is it reachable for you?
What it is. Able2Shell is a set of 33 issues in N-able N-central, disclosed with proof-of-concept code. The researcher tested N-central Appliance 2026.4.0.31 and wrote that "most if not all vulnerabilities should work on previous versions, including the most up to date version." N-able fixed it in N-central 2026.4 HF2 (build 2026.4.1.26) on November 10, 2026.
CVEs fixed in HF2, per N-able. CVE-2026-125883 (multiple XXE vulnerabilities), CVE-2026-125878 (multiple OGNL injection vulnerabilities), CVE-2026-125879 (local privilege escalation to root), CVE-2026-125880 (stored XSS via patch metadata, admin context), CVE-2026-125881 (SSRF via service import schema validation), CVE-2026-125882 (RCE via file repository upload path traversal, credited to Nate Fair of Sprocket Security) and CVE-2026-91000 (insecure IPC channels leading to local privilege escalation). N-able's notes do not say which Able2Shell issues each CVE covers.
Not to be confused with. N-central 2026.4 HF1 (build 2026.4.0.32), released in early November, is a separate update for three AlmaLinux CVEs. HF2 supersedes it. Earlier 2026 N-central CVEs, such as CVE-2026-86218, are also separate.
Checks. Run these only on systems your organization owns or runs for customers under contract.
- Is the server on build 2026.4.1.26 or later? This decides exposure. N-able supports upgrading to HF2 from 2025.4 and later; older servers must first move to a supported build. Until the server runs HF2, N-able's guidance is to keep it offline.
- Are the Agents and Probes upgraded? N-able says all customers, hosted and on-premises, must upgrade Agents and Probes. Upgrade Agents first, then Probes, because a Probe on 2026.4.1.26 cannot talk to Agents that have not been upgraded.
- Can the server's web interfaces be reached from an untrusted network? Rapid7 and CCB Belgium both report that some of the published chains need no login. A server that is not yet on HF2 and is reachable from an untrusted network is exposed.
Hosted customers. N-able upgrades hosted servers and says no server action is needed, but hosted customers must still upgrade their Agents and Probes.
After upgrading. N-able lists a known issue in HF2: N-central's built-in remote control is temporarily disabled. Take Control continues to work. Huntress notes that N-able does not always change version numbers when it pushes live hotfixes, so confirm the build using N-able's upgrade guidance.
What is not yet known. Which of the 33 Able2Shell issues each CVE covers, CVSS scores, and the full affected version range.
Compensating controls (test them, don't assume them)
Upgrading the server to N-central 2026.4 HF2 (build 2026.4.1.26), then Agents and Probes, is the fix. Until the server is upgraded, N-able's guidance is to keep it offline.
- Keep on-premises N-central offline until it runs HF2. N-able's status page says "N-able strongly advises customers operating On-Premises N-central servers to temporarily take their N-central servers offline and keep them offline until N-able provides further guidance confirming they can safely be brought back online." The same notice says "We continue to recommend that N-central remain offline until the hotfix is available and your server has been successfully upgraded." This only helps if the server is fully unreachable, and managed endpoints will not receive scripts, patches or monitoring from it while it is down.
What to look for in logs
No source has published specific indicators such as IP addresses, file hashes or log signatures for Able2Shell. These are the reviews the sources recommend, from November 8 onward.
- Huntress recommends reviewing "login and authentication activity from November 8 onward for unexpected or unauthorized access."
- Huntress also recommends checking audit logs for "anomalous remote access sessions, new scripts being deployed, or the unauthorized creation of new administrator accounts."
- CCB Belgium recommends looking on the N-central server and managed devices "for unexpected accounts, files, scripts or remote sessions since 8 November," and rotating credentials stored in N-central.
If you find suspicious activity, Huntress advises involving your incident-response team and assessing whether systems or client networks managed through N-central may also be affected.
FAQ
Am I exposed to Able2Shell?
If you run N-central on premises below build 2026.4.1.26 and the server is online and reachable over the network, treat it as exposed. Hosted servers are upgraded by N-able.
Is there a patch for N-central Able2Shell?
Yes. N-able released N-central 2026.4 HF2, build 2026.4.1.26, on November 10, 2026. On-premises customers upgrade their own servers, N-able upgrades hosted servers, and all customers must upgrade Agents and Probes, Agents first.
Do I need to upgrade Agents and Probes too?
Yes. N-able says both hosted and on-premises customers must upgrade them. Upgrade Agents first, then Probes, so Agents keep talking to the Probe.
Does Able2Shell have a CVE?
N-able's HF2 release notes list seven CVEs, CVE-2026-125878 through CVE-2026-125883 and CVE-2026-91000, without CVSS scores. The notes do not use the Able2Shell name or say which issue each CVE covers.
Is Able2Shell being exploited?
N-able says "As expected, we are observing scanning activity associated with the published proof-of-concept code. At this time, we have no evidence that any customer environment has been successfully exploited." None of the seven CVEs is on CISA KEV as of the November 10, 2026 catalog. Status is Not observed, with public exploit code.
- Vendor
- N-able
- Product
- N-able N-central server, on-premises and hosted
- Affected versions
- Researcher tested N-central Appliance 2026.4.0.31 (a pre-release build) and says most if not all issues should work on earlier versions. N-able has not published an affected-version range. Fixed in N-central 2026.4 HF2, build 2026.4.1.26
- Vulnerable component
- N-central server web interfaces; N-able has not published component details
- CVSS
- N-able published CVE IDs with the fix but no CVSS scores. CCB Belgium rates it Critical. N-able calls HF2 "a critical security update"
- CVSS vector
- Not published
- CWE
- Not published. CCB Belgium lists credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity injection and remote code execution
- Exploitation
- Not observed
- CISA KEV added
- Patch
- N-central 2026.4 HF2, build 2026.4.1.26 (November 10, 2026). Upgrade paths are supported from 2025.4 and later; older versions must first move to a supported build. On-premises customers upgrade their own servers, and N-able upgrades hosted servers. All customers then upgrade Agents first, then Probes
Updates
Nov 10, 2026. N-able released N-central 2026.4 HF2 (build 2026.4.1.26) at 3:48 PM ET with seven CVEs (CVE-2026-125878 through CVE-2026-125883 and CVE-2026-91000). On-premises customers upgrade their own servers; all customers upgrade Agents, then Probes. Not on CISA KEV; no exploitation statement in the release notes.
Nov 10, 2026. First published. No CVE, no CVSS score and no hotfix yet; N-able advises keeping on-premises servers offline and reports scanning with no evidence of successful exploitation; not on CISA KEV.
Sources
- N-able, N-central 2026.4 HF2 release notes (build 2026.4.1.26, Nov 10, 2026)
- N-able status page, N-central Critical Security Incident and release readiness update (Nov 10, 2026)
- Rapid7, Critical vulnerabilities in N-able N-central prompt hosted shutdown (Nov 10, 2026)
- CCB Belgium, Warning: N-able zero-day vulnerabilities can lead to full compromise! (Nov 10, 2026)
- Huntress, N-able disables cloud services following disclosure of Able2Shell exploit chains (Nov 9, 2026)
- The Hacker News (Nov 10, 2026)
- Researcher disclosure, Able2Shell (tested version only; not run)
- N-able, N-central 2026.4 HF1 release notes (separate update)
- CISA Known Exploited Vulnerabilities catalog (not listed; checked catalog version 2026.11.10)
We publish an advisory when a vulnerability is Critical or on CISA KEV, has one identifiable component to check, and has a public proof of concept or reported exploitation. Advisories are updated as exploitation status changes.