[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ft2CQ0to5EfyhteaM2IyTSBL9pZLuxqF2AX2rd0BvumY":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"10363c00-450a-4bd7-b1b6-3eb008e90604","Critical vulnerabilities in N-able N-central prompt hosted shutdown","critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown-882da6","Overview On November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform. In a public disclosure titled Able2Shell, an independent researcher has published details and proof-of-concept (PoC) code covering 33 issues. According to the disclosure, the issues include unauthenticated remote code execution (RCE), privilege escalation to root, credential disclosure, and unauthorized account creation. One unauthenticated chain combines XML external entity (XXE) and session-handling weaknesses to execute code as the nable service account. Other demonstrated chains involve an administrator viewing malicious patch metadata or use ProductAdmin credentials. Rapid7 Intelligence is currently triaging the newly published details. As of November 10, N-able reported scanning activity associated with the published PoC code and said it had no evidence that any customer environment had been successfully exploited. The vendor has advised keeping N-central deployments offline while it develops and validates a hotfix. Hosted N-central classic environments remain offline, according to the same notice. N-able's notice does not yet include CVE identifiers or CVSS scores. N-central is used by managed service providers (MSPs) and enterprise IT teams to administer endpoints and infrastructure. Compromise of an RMM server can put downstream managed environments at risk. N-central has previously been targeted through separate vulnerabilities, including an authentication bypass covered by Rapid7 in August 2026. Given the platform's administrative reach and the availability of public exploit code, Rapid7 recommends treating the current disclosure as an emergency. Mitigation guidance Rapid7 strongly recommends that organizations operating on-premises N-central servers take them offline immediately and keep them offline until the hotfix is available, and the server has been successfully upgraded. Hosted customers should follow the vendor's service restoration updates. N-able is developing and validating a hotfix, with a target of midday November 10 EST. Affected versions: The researcher reports testing N-central Appliance 2026.4.0.31. N-able's current notice does not specify the full affected-version range. Fixed versions: N-able's incident notice does not yet identify a remediation build. Follow the incident notice for release confirmation and installation instructions. Rapid7 also recommends reviewing N-central servers and downstream managed systems for signs of compromise and engaging incident responders if suspicious activity is identified. For the latest mitigation guidance, please refer to N-able's security incident notice. Updates November 10, 2026: Initial publication.","N-able announced critical vulnerabilities in its N-central RMM platform following a public disclosure detailing 33 issues, including unauthenticated RCE and privilege escalation. While N-able has reported scanning activity associated with the exploit code, there is no evidence of customer exploitation yet. The vendor has advised taking N-central deployments offline until a hotfix is available, with hosted environments remaining offline.","N-able N-central RMM platform impacted by 33 critical vulnerabilities, prompting vendor-hosted shutdowns.","https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Fetr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown","https:\u002F\u002Fimages.contentstack.io\u002Fv3\u002Fassets\u002Fblte4f029e766e6b253\u002Fblt65a432ba319f4043\u002F6846abddaf18306debe6cf4d\u002FETR.webp","2026-11-10T14:20:34+00:00","2026-11-10T15:00:04.512833+00:00",8,[17,20,23],{"name":18,"type":19},"N-central","product",{"name":21,"type":22},"N-able","vendor",{"name":24,"type":25},"RMM","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":46,"value":47,"context":48},"malware","Able2Shell","Name of the public disclosure detailing vulnerabilities in N-able N-central.",[21,18],{"controls":51,"vendors":139},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":82,"name":83,"problem":84,"products":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":111,"name":112,"problem":113,"products":114},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[140],{"slug":74,"name":75,"logo_path":76,"roles":141},[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"33-critical-flaws-in-n-central-rmm-force-emergency-shutdown","33 Critical Flaws in N-central RMM Force Emergency Shutdown","N-able's N-central RMM platform was found to contain 33 vulnerabilities, including unauthenticated remote code execution and privilege escalation, forcing the vendor to take hosted environments offline entirely. RMM platforms are high-value targets because they hold privileged access to thousands of managed endpoints, meaning a single compromise can cascade across an entire customer base. The fact that exploit code was publicly disclosed before a patch was available created an immediate and severe window of exposure. This incident underscores the danger of deploying security-critical management tools without a rapid, tested remediation process for critical vulnerabilities.",[148,149,150,151,152],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","NIST CSF 2.0 RS.MI-01: Incidents are contained",{"NIS2 Article 21(2)(e)":154,"NIST SP 800-53 SI-2: Flaw Remediation":155,"NIST CSF 2.0 RS.MI-01: Incidents are contained":156,"CIS Control 7: Continuous Vulnerability Management (v8)":157,"CIS Control 2: Inventory and Control of Software Assets (v8)":158},"This point covers vulnerability handling and disclosure in acquisition and maintenance, directly applicable to managing a critical third-party RMM platform with publicly released exploit code.","SI-2 requires organizations to identify, report, and correct information system flaws promptly, which would have driven an emergency response process when the public disclosure occurred.","Taking N-central offline before confirmed exploitation is exactly the kind of containment action this category mandates to limit the blast radius of an actively threatened vulnerability.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; a formal process here would have ensured faster detection of the 33 flaws and immediate isolation pending a patch.","Knowing exactly where N-central is deployed across the environment is a prerequisite for rapidly taking affected instances offline, which CIS Control 2 directly addresses."]