Able2Shell: Frequently asked questions for reported N-able N-central zero-day vulnerabilities
Source Tenable Research
Fixed in 2026.4.1.26 : patch affected systems soon.
Data as of 11 Nov 2026, 06:05 UTC
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 2026.4.1.26
What to do
AI-suggested
N-able has released N-central 2026.4 Hotfix 2, which addresses the seven most critical vulnerabilities disclosed in Able2Shell. Users should apply this hotfix immediately to mitigate these risks. N-able has indicated that a follow-up hotfix will address additional vulnerabilities. Hosted N-central services were temporarily taken offline by N-able as a precaution. No further immediate action is required beyond applying the official hotfix and monitoring for subsequent updates from N-able.
Description
Able2Shell is a collection of 33 reported zero-day vulnerabilities in N-able N-central, disclosed publicly with proof-of-concept code. Among these, seven critical vulnerabilities have been officially recognized and patched by N-able in the N-central 2026.4 Hotfix 2 release. The vulnerabilities include high-severity issues such as XML external entity (XXE) attacks, server-side request forgery (SSRF), OGNL injection, local privilege escalation, remote code execution, and stored cross-site scripting (XSS). One exploit chain allows unauthenticated remote command execution as the nable user, and others can lead to root privileges through chained exploits. N-able has confirmed and patched the most critical issues but has not mapped all 33 findings individually. The affected versions are N-central prior to 2026.4.1.26. No confirmed customer compromises have been reported as of November 10, 2026.