On November 9, 2026, N-able took its N-central platform offline due to the disclosure of 33 critical zero-day vulnerabilities. These vulnerabilities include exploit chains that could lead to remote code execution and privilege escalation.
The vulnerabilities were disclosed by a researcher using the name Oracle-Security on GitHub, in a post titled 'Able2Shell'. The disclosed issues include unauthenticated XML External Entity (XXE) attacks.
N-able has not observed any active exploitation of these vulnerabilities at the time of the advisory. However, the company has advised all customers using on-premises versions of the N-central platform to take their servers offline as a precautionary measure.
The N-central platform, widely used by managed service providers for remote monitoring and management, is affected by these vulnerabilities. N-able is currently preparing a hotfix to address the issues.
N-able has released multiple emergency hotfixes since August 1, 2026, in response to previous vulnerabilities.