---
title: N-able takes hosted N-central offline and tells on-prem customers to shut their servers down after a researcher published 33 "Able2Shell" zero-days with exploit code | ctxsec
url: https://ctxsec.com/items/n-able-n-central-able2shell-33-zero-days-hosted-offline-nov-9
description: "An independent researcher published 33 vulnerabilities in N-central, N-able's remote monitoring and management platform for MSPs, with proof-of-concept exploits, tested against N-central Appliance 2026.4.0.31. N-able called it a non-responsible public disclosure, took all hosted N-central regions offline, and told on-premises customers to take their servers offline until it says otherwise. It says it has seen no active exploitation and expects a hotfix build around midday ET on Nov 10. watchTowr says it saw exploitation attempts against N-central honeypots overnight."
status: "official (N-able status page incident 202561, opened Nov 9, 2026 15:15 UTC, updates through Nov 10 09:46 UTC); exploitation attempts against honeypots per watchTowr on X (Nov 10); N-able says it has seen no active exploitation or customer compromise; no CVEs assigned yet"
published: 2026-11-10
---

> An independent researcher published 33 vulnerabilities in N-central, N-able's remote monitoring and management platform for MSPs, with proof-of-concept exploits, tested against N-central Appliance 2026.4.0.31. N-able called it a non-responsible public disclosure, took all hosted N-central regions offline, and told on-premises customers to take their servers offline until it says otherwise. It says it has seen no active exploitation and expects a hotfix build around midday ET on Nov 10. watchTowr says it saw exploitation attempts against N-central honeypots overnight.

[← Cybersecurity News](/news) · [markdown](/items/n-able-n-central-able2shell-33-zero-days-hosted-offline-nov-9.md)

official (N-able status page incident 202561, opened Nov 9, 2026 15:15 UTC, updates through Nov 10 09:46 UTC); exploitation attempts against honeypots per watchTowr on X (Nov 10); N-able says it has seen no active exploitation or customer compromise; no CVEs assigned yet

2026-11-10

### N-able takes hosted N-central offline and tells on-prem customers to shut their servers down after a researcher published 33 "Able2Shell" zero-days with exploit code

- **Why it matters:** an RMM server can push scripts and remote sessions to every managed endpoint at every client. Huntress says the published chains include three paths to remote code execution and one to root; reported bug classes include anonymous credential theft, admin creation, XXE, XSS-to-OGNL and a stack overflow.
- **What N-able says to do:** keep hosted and on-prem N-central offline until it confirms they can be restored. Ecoverse services under N-able Login (n-able.app) stay up for asset view, patching, scripting and Take Control.
- **Hotfix:** N-able's Nov 10 09:46 UTC update said it was aiming for a build around midday ET and that the time is provisional. This is the fourth batch of serious N-central flaws this year, after CVE-2026-18556 in August and the exploited CVE-2026-86218 in September.
- See the playbook for an RMM-outage checklist.

Sources: [N-able status: N-central Critical Security Incident (event 202561)](https://uptime.n-able.com/event/202561/) · [watchTowr on X: exploitation attempts against N-central honeypots (Nov 10, 2026)](https://x.com/watchtowrcyber/status/2120096657366827381) · [Huntress: N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains (Nov 9, 2026)](https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains) · [The Hacker News (Nov 10, 2026)](https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html)