N-able’s N-central, a remote management tool that IT service providers use to patch, script and support their clients’ computers, is down worldwide. The hosted version went dark on 9 November, and customers running N-central on their own hardware were asked to power those servers off as well. The trigger was a public dump of exploit code for 33 alleged zero-day flaws. One compromised server can reach every machine it manages, which is why the response was so blunt.
The outage spans the Americas, Europe and Asia-Pacific. At 15:15 UTC that day N-able said it had seen no active exploitation, and it is preparing a hotfix with no date attached. Servers should stay off until N-able gives the all-clear.
Security firm Huntress found that the flaws combine into four attack chains: three end in remote code execution, and the fourth lifts an attacker to root. The code, packaged under the name Able2Shell, was run against build 2026.4.0.31, and Huntress expects older builds to be vulnerable as well.
Researcher Sean Bales said in an interview that his most serious chain begins with an XML external entity flaw in the service-import feature, needing no login. From there an attacker can steal a local session, reset a password, run commands as the server’s service account and create a default administrator. He added that AI assisted the bug hunt. Bales says he gave N-able no warning because reports he filed five or six months ago on another N-able product remain unpatched. The company’s chief executive and chief technology officer then asked him to remove the code, he said. N-able has not responded to his claims, and the flaws have not all been independently verified.
N-central has had a rough year already. In August it patched CVE-2026-18556, which gave attackers unauthenticated control of the console, and CVE-2026-18577 followed as an incomplete fix. A September hotfix covered CVE-2026-86218, a remote code execution bug that was being exploited and carries a 10.0 severity score. Huntress treats those as separate from Able2Shell, so earlier patches offer no cover here.
Huntress advises checking login and authentication records from 8 November onward for unexpected administrator accounts, strange remote sessions and scripts nobody deployed. Any hit means checking the managed customers’ networks too, not just the server. Live hotfixes may leave the displayed version number unchanged, so wait for N-able’s explicit go-ahead rather than trusting the build string. Hosted customers can still reach some functions through a separate application portal with N-able Login, and N-able has promised updates every four hours on its incident page.
