Able2Shell: 33 N-able N-central Zero-Days Under Attack

Exploitation attempts against N-able N-central servers have begun, security firm watchTowr reported on Tuesday, a day after a researcher published 33 unpatched vulnerabilities under the name Able2Shell and N-able took its hosted N-central platform offline worldwide.

N-central is the remote monitoring and management (RMM) server that managed service providers and IT teams use to patch, script and remotely control customer machines. The Able2Shell release covers 33 flaws in that server, and the researcher says they allow credential theft, creation of rogue administrator accounts and remote code execution up to root, in some cases without logging in. None of the 33 issues has a CVE ID or a CVSS score yet.

Security researcher Sean Bales, who posts on X as @seankbales, published the findings with proof-of-concept code on GitHub late on Sunday, November 8, US time, without notifying N-able first. N-able opened a critical security incident at 15:15 UTC on Monday, November 9, saying it was responding to a “public disclosure and non-responsible communication of critical vulnerabilities” in N-central.

As of Tuesday, November 10, hosted N-central remains offline in the Americas, Europe and Asia-Pacific; on-premises customers have been told to keep their servers switched off, and no fix has shipped. N-able’s latest estimate puts the hotfix at around midday US Eastern time on November 10.

Is Able2Shell Being Exploited?

watchTowr said on Tuesday, November 10, that its honeypots, decoy servers built to look like real N-central installations, recorded Able2Shell exploitation attempts overnight. The company posted a captured inbound request as evidence and told N-central operators to audit for signs of compromise, restrict access and follow N-able’s mitigation guidance.

N-able’s own statements say something narrower. The company said on November 9 that it had seen no active exploitation of the Able2Shell vulnerabilities, and a later update added that it had no evidence of unauthorised data access. Those statements predate watchTowr’s report, and an attempt against a honeypot is not a confirmed breach of a customer server.

No confirmed compromise through Able2Shell has been reported as of November 10. The vulnerabilities are not in CISA’s Known Exploited Vulnerabilities catalog, which lists flaws by CVE ID, and Able2Shell has none.

Why the Researcher Skipped Coordinated Disclosure

Bales told BleepingComputer that he released the N-central flaws without warning because N-able had not fixed three vulnerabilities he reported in a different N-able product five to six months ago. He said follow-up emails went unanswered and that N-able’s handling showed “they don’t take disclosure seriously”.

Bales also told the outlet that the research was AI-assisted, and that N-able executives contacted him after the release and asked him to take the repository down. The repository was still online on November 10. N-able has not publicly addressed his account of the earlier reports.

Which N-central Versions Are Affected

N-able has not published a list of affected N-central versions. Its guidance treats every deployment as exposed: all hosted environments are offline, and every on-premises server is to stay offline regardless of build.

Bales tested on N-central Appliance 2026.4.0.31, which his write-up describes as a pre-release build, and wrote that “most if not all vulnerabilities should work on previous versions”. N-able’s release notes list the general 2026.4 release as build 2026.4.0.23, so servers on the current public release should be assumed vulnerable.

Able2Shell is the third N-central security emergency since August. Authentication bypasses CVE-2026-18556 and CVE-2026-18577 were exploited in August, and CVE-2026-86218, a pre-authentication remote code execution flaw rated CVSS 10.0, followed in September and was fixed in 2026.3 Hotfix 4. Shadowserver counted nearly 1,500 N-central servers reachable from the internet at that time.

What N-central Admins Should Do Now

On-premises N-central servers should stay offline until N-able confirms they can return. N-able lists no other workaround for Able2Shell, and no configuration change has been offered as a substitute for disconnecting the server.

Hosted N-central customers have nothing to switch off, because N-able has already taken those environments down. N-able says its separate N-able.app console remains available for urgent patching and monitoring during the outage.

Huntress advises reviewing N-central login and authentication activity from November 8 onward and checking for administrator accounts nobody created, scripts nobody deployed and remote-control sessions nobody started. Any of those is a reason to bring in incident response and to check the customer networks managed through that server.

Huntress also notes that N-able sometimes ships live hotfixes without changing the version number, so a patched server may still report the same build. Admins should confirm the fix against N-able’s release notes when the hotfix arrives, not against the version string alone.