{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/n-central-2026.4.0.31/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["N-central (2026.4.0.31)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","zero-day","rce","n-able"],"_cs_type":"threat","_cs_vendors":["N-able"],"content_html":"\u003cp\u003eN-able has taken its hosted N-central environment offline and advised on-premises customers to shut down their servers following the public disclosure of 33 zero-day vulnerabilities by researcher Sean Bales. These vulnerabilities, collectively referred to as Able2Shell, were tested against N-central Appliance version 2026.4.0.31. Affected environments include both hosted and on-premises deployments across the Americas, APAC, and Europe. N-able is currently developing hotfixes.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003cp\u003eDocumented exploit chains involve:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eXXE / NCI trust abuse.\u003c/li\u003e\n\u003cli\u003eSupport-token theft.\u003c/li\u003e\n\u003cli\u003eUnsigned NSP execution.\u003c/li\u003e\n\u003cli\u003eXSS-to-OGNL injection.\u003c/li\u003e\n\u003cli\u003eAuthenticated reverse shells.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for anonymous credential theft, the creation of unauthorized administrator accounts, and remote code execution with root privileges. Additional impacts include arbitrary file writes, directory traversal, MDM impersonation, and audit tampering.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eShut down all on-premises N-central servers immediately per N-able's instructions.\u003c/li\u003e\n\u003cli\u003eMonitor N-able official support channels for the release of hotfixes for version 2026.4.0.31 and apply them immediately upon availability.\u003c/li\u003e\n\u003cli\u003eAudit N-central logs for unauthorized administrative account creation and unexpected reverse shell activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T07:35:12Z","date_published":"2026-11-10T07:35:12Z","id":"https://feed.craftedsignal.io/briefs/2026-11-n-able-n-central-vulnerabilities/","summary":"Security researcher Sean Bales disclosed 33 zero-day vulnerabilities, collectively known as Able2Shell, affecting N-able N-central and enabling remote code execution, credential theft, and unauthorized administrative access.","title":"N-able N-central: Multiple zero-day vulnerabilities (Able2Shell)","url":"https://feed.craftedsignal.io/briefs/2026-11-n-able-n-central-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - N-Central (2026.4.0.31)","version":"https://jsonfeed.org/version/1.1"}