This article first appeared on varaxontech.com, where it is kept up to date.
The short version
- On 8 to 9 November 2026 a researcher published working exploit code for flaws in N-able N-central. N-able took hosted N-central offline on 9 November and shipped 2026.4 Hotfix 2 (build 2026.4.1.26) on 10 November with seven CVE fixes.
- More exploit code followed. N-able says the newer chains need the Legacy API, a setting that is off by default. Make sure it is off, upgrade to HF2, then upgrade every Agent and Probe. A further hotfix, HF3, was still in validation on 14 November.
- N-able published indicators of compromise on 13 November for servers that had the Legacy API turned on. Check your logs and firewall for them before you call the incident closed.
- This is N-central's fourth serious incident of 2026: three earlier N-central CVEs are on CISA's Known Exploited Vulnerabilities list, each with a 3-day federal deadline.
If you run N-central, the past week has been rough. Exploit code for what the researcher says are dozens of flaws went public with no warning to the vendor, the hosted service went dark, a hotfix arrived, and more exploit code landed the day after. Advice changed several times along the way.
This page cuts it down to what N-able itself has said, what you should check on your own servers, and how to show your clients you are clear. Every fact below comes from N-able's status page and HF2 release notes, CISA's KEV catalog and FIRST's EPSS scores, all read on 14 November 2026. We will update it when N-able releases HF3.
What happened, day by day
The Able2Shell timeline, from N-able's status page and release notes
| Date (UTC) | What happened |
|---|---|
| 8 to 9 Nov | An independent researcher publishes proof-of-concept exploit code for N-central, under the name Able2Shell. N-able calls the disclosure non-responsible and says it was not reported through its channels. |
| 9 Nov | N-able takes hosted N-central (all regions) offline as a precaution and tells on-premises customers to keep their servers offline until they can upgrade. It reports scanning activity tied to the published code. |
| 10 Nov | N-central 2026.4 HF2 (build 2026.4.1.26) ships with seven CVEs. Hosted servers are upgraded and brought back. N-able says a follow-up hotfix will come. |
| 12 Nov | After further disclosures, N-able restricts features: on-premises customers must make sure the Legacy API is disabled, and the Intune integration is switched off as a precaution. N-able says it has seen no signs of compromise. |
| 13 Nov | N-able publishes indicators of compromise that apply only to servers where the Legacy API was not disabled. |
| 14 Nov | HF3 is still in validation. N-able says it will not be available on 14 November and promises an update on the morning of 15 November (US Eastern). |
Still moving: N-able's own guidance has changed from day to day. Before you act, read the newest entry on the N-able status page. Where this page and N-able disagree, N-able wins.
The CVEs fixed in HF2
N-able's HF2 release notes list seven CVEs. The researcher's write-up claims many more issues than that. N-able has not said how many of them it reproduced, and it has promised a further hotfix, so treat HF2 as the floor, not the finish line.
CVEs fixed in N-central 2026.4 HF2 (build 2026.4.1.26), as N-able describes them
| CVE | What it is |
|---|---|
| CVE-2026-125883 | Multiple XML external entity (XXE) flaws |
| CVE-2026-125878 | Multiple OGNL injection flaws |
| CVE-2026-125879 | Local privilege escalation to root through a syslog-ng config the nable user can write |
| CVE-2026-125880 | Stored cross-site scripting through MMS3 patch metadata, run in an admin's session |
| CVE-2026-125881 | Server-side request forgery through service import schema validation |
| CVE-2026-125882 | Remote code execution through path traversal in file repository uploads |
| CVE-2026-91000 | Insecure IPC channels that allow local privilege escalation |
None of the seven is on CISA's Known Exploited Vulnerabilities (KEV) catalog as of its 13 November update, and their EPSS scores were all under 1% on 14 November. Do not read that as "low risk". EPSS is a model that needs time to catch up with new CVEs, the exploit code is public, and N-able itself reports scanning against it. On a tool that can run commands on every endpoint you manage, public exploit code is enough reason to act today.
What to do now, in order
If you run N-central on-premises
- Make sure the Legacy API is off. It is disabled by default, but check: if anyone turned it on, follow N-able's article How to disable Legacy API settings on on-premises N-central servers. N-able ties the newer exploit chains and its published indicators to this setting.
- Upgrade the server to 2026.4 HF2, build 2026.4.1.26. N-able supports the upgrade from 2025.4 onward; older servers need its legacy upgrade path first. Until the upgrade is done, N-able's advice was to keep the server offline.
- Upgrade every Agent and Probe, Agents first. HF2 changes how Agents and Probes talk. An upgraded Probe cannot talk to Agents that are not yet on 2026.4.1.26, so features such as the offline patch cache stop until both sides match. Upgrading Agents first avoids the gap.
- Cut internet exposure to the minimum. The management interface should not be open to the whole internet. If your Agents and Probes need to reach the server from outside, scope what is reachable as tightly as your setup allows.
- Check for the indicators of compromise listed below, especially if the Legacy API was ever on.
- Watch for HF3 and apply it when N-able releases it.
If you use hosted N-central
N-able upgrades hosted servers and has applied the temporary restrictions for you. Your job is the Agents and Probes: N-able says every customer, hosted or not, must upgrade them. Expect built-in remote control to stay off for now; N-able lists it as temporarily disabled in HF2, while Take Control keeps working.
N-able's indicators of compromise
On 13 November N-able published these indicators, which it says apply only to servers that had the Legacy API enabled. They are written in the usual "defanged" form so nobody clicks them by accident. Search your firewall, proxy and DNS logs from 8 November onward.
- Downloads from
hxxp://157.20.241[.]16:8080/(paths seen:jup.sh,xvgz,xmrig.tgz,ob/cronhit,ob/fcheck) - Outbound traffic to
157.20.241[.]16on port 8080 or ports 19202 to 19418 - Outbound traffic to
139.99.69[.]109:10128 - Outbound traffic to
79.76.51[.]56:39100
One of the file names, xmrig, is a well-known cryptocurrency miner. A miner on your RMM server is bad news on its own, but the bigger worry is the access it implies: whoever could install it could also push scripts to every managed machine. If you find a hit, treat it as a full incident: keep the logs and a snapshot, rotate every N-central admin, technician and integration credential, and review recent scripts, scheduled tasks and remote sessions sent to client endpoints.
The fourth N-central emergency of 2026
Able2Shell did not come out of nowhere. CISA has added three N-central CVEs to its KEV catalog this year, which means it had evidence of each one being used in real attacks. Each came with a 3-day fix deadline for US federal agencies.
N-central CVEs on CISA's KEV catalog in 2026 (CISA feed, catalog version 2026.11.13; EPSS from FIRST on 14 November 2026)
| CVE | CISA's description | Added to KEV | Federal deadline | EPSS today |
|---|---|---|---|---|
| CVE-2026-18577 | Authentication bypass and account takeover; the result of an incomplete patch for CVE-2026-18556 | 3 Aug 2026 | 6 Aug 2026 | 14.6% |
| CVE-2026-18556 | Authentication bypass using an alternate path or channel | 4 Aug 2026 | 7 Aug 2026 | 43.9% |
| CVE-2026-86218 | Static code injection allowing remote code execution before sign-in | 8 Sep 2026 | 11 Sep 2026 | 15.4% |
Those EPSS scores sit in the top 4% of all scored CVEs. For an MSP, the pattern matters more than any single CVE: your RMM is the single place an attacker can reach every client at once, and attackers know it. Treat the RMM server itself as the most important asset you scan, not as plumbing.
How to show clients you are clear
Clients will ask. "We patched" is a claim; a before-and-after scan is evidence. A short routine that works with whatever scanner you already use:
- Scan the N-central server from outside. An external scan shows what the internet can actually reach. Note every open port and web path before you change anything.
- Run an authenticated scan inside and look for the HF2 CVEs by ID. If your scanner has no check for them yet, record the build number you installed (2026.4.1.26) instead. Responders have noted that a hotfix does not always change the version string a scanner sees, so confirm the build using N-able's upgrade documentation.
- Record the Legacy API setting (screenshot or config export) and the date you confirmed it was off.
- Rescan after the upgrade and after HF3. The difference between the two scans is your proof of fix: what was exposed, what changed, and when.
- Write it up in plain words for each client: did this affect you, what did we do, and is anything still open. Our guide to explaining findings to non-technical clients has wording that works.
Varaxon Scan Hub does the bookkeeping part of this: it reads your scan exports, flags anything on CISA's KEV list, compares each rescan with the last one and turns the result into a client-ready report. It does not replace N-able's hotfix or your own judgement on the incident. If you want to see how the comparison looks with your own files, the compare two scans guide walks through it.
Common questions
What is Able2Shell?
Able2Shell is the name a security researcher gave to a set of N-able N-central flaws and exploit chains published on 8 to 9 November 2026, without warning the vendor first. Further releases followed (named 4EverAble2Shell and Agent2Shell), and N-able answered them with the restrictions it announced on 12 November.
Which N-central version fixes Able2Shell?
N-central 2026.4 Hotfix 2, build 2026.4.1.26, released on 10 November 2026, fixes seven CVEs. N-able says a further hotfix (HF3) is coming, and was still validating it on 14 November. Install HF2 now and HF3 when it ships.
Is hosted N-central affected?
N-able took hosted N-central offline on 9 November, upgraded it to HF2 and brought it back on 10 November. It has applied its later restrictions to hosted servers itself. Hosted customers still have to upgrade their own Agents and Probes.
What is the N-central Legacy API and should it be on?
It is an older API setting that N-able ships turned off. N-able says the newer exploit chains and the indicators of compromise it published apply only to servers where it was turned on. Unless you have a hard dependency on it, keep it off.
Are the Able2Shell CVEs on CISA's KEV list?
Not as of CISA's 13 November 2026 update. Three earlier 2026 N-central CVEs are: CVE-2026-18577, CVE-2026-18556 and CVE-2026-86218. You can check any CVE against KEV and EPSS with our free CVE checker.
Originally published at https://varaxontech.com/guides/n-central-able2shell-vulnerabilities. Varaxon Scan Hub turns vulnerability scan exports into evidence-led client reports, ranked by CISA KEV and EPSS.
