Most advisories say patch now. This one says turn it off.
On November 9, N-able took hosted N-central offline and told every on-prem customer to shut down their servers entirely until further notice. No workaround, no patch, no CVE IDs.
The trigger: researcher Sean Bales published 33 zero-days on GitHub with working PoC code and a video demo. The disclosure is called Able2Shell.
The worst chain
Unauthenticated XXE in service-import → steal a local session → reset a password → RCE as nable → create a persistent admin account with attacker-chosen credentials.
No login required. The account survives a restart and looks legitimate in the logs.
Why it's worse than a typical vuln
N-central is an RMM. It patches, deploys software, and opens remote shells across every client an MSP manages. The blast radius isn't the server — it's every endpoint downstream.
This is also N-central's fifth emergency cycle since August. CVE-2026-86218 (pre-auth RCE, CVSS 10.0) was in CISA KEV. Volt Typhoon was exploiting earlier N-central zero-days last month.
What to do
- Take every N-central server offline — prod, test, staging, DR
- Check the admin list for accounts you didn't create
- Review auth activity from November 8 (when PoC published, not when cloud went offline)
- Rotate credentials if anything looks off
- Assess downstream clients — this is a supply-chain event
Full analysis + mitigation checklist → threataft.com
Top comments (0)