N-able takes hosted N-central offline and tells on-prem customers to shut their servers down after a researcher published 33 "Able2Shell" zero-days with exploit code

official (N-able status page incident 202561, opened Nov 9, 2026 15:15 UTC, updates through Nov 10 09:46 UTC); exploitation attempts against honeypots per watchTowr on X (Nov 10); N-able says it has seen no active exploitation or customer compromise; no CVEs assigned yet2026-11-10

N-able takes hosted N-central offline and tells on-prem customers to shut their servers down after a researcher published 33 "Able2Shell" zero-days with exploit code

Why it matters: an RMM server can push scripts and remote sessions to every managed endpoint at every client. Huntress says the published chains include three paths to remote code execution and one to root; reported bug classes include anonymous credential theft, admin creation, XXE, XSS-to-OGNL and a stack overflow.
What N-able says to do: keep hosted and on-prem N-central offline until it confirms they can be restored. Ecoverse services under N-able Login (n-able.app) stay up for asset view, patching, scripting and Take Control.
Hotfix: N-able's Nov 10 09:46 UTC update said it was aiming for a build around midday ET and that the time is provisional. This is the fourth batch of serious N-central flaws this year, after CVE-2026-18556 in August and the exploited CVE-2026-86218 in September.
See the playbook for an RMM-outage checklist.

Sources: N-able status: N-central Critical Security Incident (event 202561) · watchTowr on X: exploitation attempts against N-central honeypots (Nov 10, 2026) · Huntress: N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains (Nov 9, 2026) · The Hacker News (Nov 10, 2026)