N-able N-central: Multiple zero-day vulnerabilities (Able2Shell)

N-able has taken its hosted N-central environment offline and advised on-premises customers to shut down their servers following the public disclosure of 33 zero-day vulnerabilities by researcher Sean Bales. These vulnerabilities, collectively referred to as Able2Shell, were tested against N-central Appliance version 2026.4.0.31. Affected environments include both hosted and on-premises deployments across the Americas, APAC, and Europe. N-able is currently developing hotfixes.

Attack Chain

Documented exploit chains involve:

1. XXE / NCI trust abuse.
2. Support-token theft.
3. Unsigned NSP execution.
4. XSS-to-OGNL injection.
5. Authenticated reverse shells.

Impact

Successful exploitation allows for anonymous credential theft, the creation of unauthorized administrator accounts, and remote code execution with root privileges. Additional impacts include arbitrary file writes, directory traversal, MDM impersonation, and audit tampering.

Recommendation

• Shut down all on-premises N-central servers immediately per N-able's instructions.
• Monitor N-able official support channels for the release of hotfixes for version 2026.4.0.31 and apply them immediately upon availability.
• Audit N-central logs for unauthorized administrative account creation and unexpected reverse shell activity.