On Monday, November 9, 2026, N-able took its hosted N-central service offline in the Americas, Europe and Asia-Pacific. It also told customers who run N-central on their own servers to shut those servers down and leave them off until N-able says they can come back. The move followed a researcher’s public release of 33 unpatched flaws, with working exploit code, in the remote monitoring tool many managed service providers use to run their clients’ computers.
If an IT provider manages your office computers, ask them today whether they use N-able N-central.
What happened
Late Sunday, November 8, security researcher Sean Bales published a set of flaws he called Able2Shell, including proof-of-concept exploits, according to BleepingComputer. Huntress, which reviewed the research, counts 33 flaws that can be chained into four attacks: three that can run code on the N-central server and one that can raise privileges to root. The researcher tested them against N-central Appliance 2026.4.0.31 and said earlier versions are likely affected.
N-able then announced a critical security incident. In a statement to BleepingComputer it said it took hosted N-central offline on November 9 as a precaution and told on-premises customers to take their servers offline until further notice. At that time it said it had not observed active exploitation.
As of mid-morning November 10, Eastern time, N-able’s status page still listed the incident as a major outage under investigation, with no end time. Hosted N-central remained offline in all three regions, and the on-premises N-central rows were marked the same way. N-able said it is seeing scanning tied to the published exploit code, but has no evidence that any customer environment has been successfully exploited. It is still working on a hotfix, with a target of midday November 10, Eastern time, and it continues to recommend that N-central stay offline until that hotfix is available and the server has been upgraded. A check of N-able’s N-central release notes found no new hotfix for this incident; the latest security hotfix listed there is still 2026.4 HF1, dated November 2, which addresses a separate issue.
What to do
- Ask your provider. If an MSP or IT firm runs your computers, ask whether they use N-able N-central, hosted or on-premises, and write down the answer.
- Upgrade before turning it back on. An on-premises server should be upgraded to N-central 2026.4 Hotfix 2 (build 2026.4.1.26) before it comes back online; N-able upgrades hosted servers itself. Then upgrade Agents first and Probes second, in both hosted and on-premises setups, as the release notes direct.
- Check logins and new admin accounts since November 8. Ask your provider to review login activity and any new administrator accounts from November 8 onward, and to look for unexpected remote sessions or new scripts, before they turn N-central back on. Huntress recommends that review because earlier N-central incidents saw attackers create admin accounts and push tools into client networks.
- Watch N-able’s status page for the all-clear. Hosted N-central comes back when N-able says so. The official page is uptime.n-able.com.
When this piece first ran, no CVE identifiers had been assigned, according to SecurityWeek. N-able’s Hotfix 2 release notes now list seven, including CVE-2026-125882 (code execution through a file repository upload path traversal) and CVE-2026-125878 (OGNL injection). The flaws were not on CISA’s Known Exploited Vulnerabilities catalog as of feed version 2026.11.09. That does not change the advice. Follow N-able’s current direction rather than waiting for a catalog entry.
If you want a second opinion on what to ask your provider, our $29 Quick Answer service covers that question.
Sources
- N-able status page (official incident 202580, checked mid-morning November 10, 2026, Eastern time: status Investigating, severity Major Outage, hotfix ETA midday November 10 EST, hosted and on-premises N-central still offline; N-able reports scanning tied to the published exploit code and no evidence of successful exploitation in a customer environment)
- BleepingComputer, “N-able takes cloud platform offline after 30+ ‘zero-days’ published”, November 9, 2026, including N-able’s statement
- Huntress, “N-able Disables Cloud Services Following Disclosure of ‘Able2Shell’ Exploit Chains”, November 9, 2026
- SecurityWeek, “N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days”, November 10, 2026 (no CVE identifiers assigned yet)
- CISA Known Exploited Vulnerabilities catalog JSON feed, version 2026.11.09 (no Able2Shell or new N-central identifiers for this incident)
- N-able, “N-central 2026.4 HF2 Release Notes”, posted November 10, 2026, 3:48 PM ET (build 2026.4.1.26, upgrade guidance, CVE list, known issues)
Related: The BeyondTrust bug was used before the patch. Check the logs. and Security and vulnerabilities, every security briefing, guide and tool in one place.