Critical vulnerabilities in N-able N-central prompt hosted shutdown
Overview On November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central , its remote monitoring and management (RMM) platform. In a public disclosure titled Able2Shell, an independent researcher has published details and proof-of-concept (PoC) code covering 33 issues. According to the disclosure, the issues include unauthenticated remote code execution (RCE), privilege escalation to root, credential disclosure, and unauthorized account creation. One unauthenticated chain combines XML external entity (XXE) and session-handling weaknesses to execute code as the nable service account. Other demonstrated chains involve an adm
- Vendor
- N-able
- Product
- N-central / N-sight
- EPSS
- 0.15 (p97)
- Exploitation
- public exploit code reported
- Fix
- available
- Exposure class
- Remote access
Why it ranks 57 (High)
- Public exploit code reported
- EPSS 0.15 (elevated)
- Exposed product class: remote access
- Covered by 5 independent sources
- Fix available
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Rapid7 research (rapid7.com)
- CVE-2026-18577 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-125883 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-125878 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-125879 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-125880 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.