SockAnalyst
← All playbooks
CriticalExploit · 2026-11-10

N-able N-central "Able2Shell": 33 public zero-days with PoCs, hosted service taken offline and on-prem servers told to shut down

SockAnalyst · Security+ certified analyst.

What happened

On November 9, 2026 independent researcher Sean Bales published 33 vulnerabilities in N-able's N-central remote monitoring and management server, with proof-of-concept exploits, collectively called Able2Shell. He tested them against N-central Appliance 2026.4.0.31; Huntress says earlier versions are likely affected too. The flaws include credential disclosure, arbitrary file writes, directory traversal, XSS, XXE and remote code execution, and chain into at least four exploits: three to remote code execution and one to root privilege escalation, including anonymous credential theft and administrator creation. N-able took its hosted N-central environments offline as a precaution, told on-premises customers to take their servers offline until it says it is safe, and said it had seen no active exploitation as of November 9 at 15:15 UTC while it builds a hotfix. watchTowr later said on X it observed exploitation attempts against N-central honeypots overnight. No CVE IDs have been assigned in the sources we checked.

Update (2026-11-13): Update Nov 13: On Nov 12 Sean Bales published two more PoC chains, 4EverAble2Shell and Agent2Shell, tested against the Nov 10 hotfix N-central 2026.4 HF2 (2026.4.1.26). 4EverAble2Shell chains Apache Axis CVE-2026-90436 (CVSS 9.8) with an N-central privilege escalation for unauthenticated root, but only where the non-default Legacy API is enabled. Previdian and Huntback saw probing from ~08:30 UTC Nov 12 and full-chain attempts from 09:16 UTC; Huntback found at least 21 production N-central servers mining Monero (19 on HF2). N-able's Nov 12 update disabled the Intune integration, restricted other features, and tells on-prem customers to confirm Legacy API is disabled and to upgrade Agents and Probes; on Nov 13 it said it had identified additional IOCs and is working with affected customers. Hunt on the server: requests to /dms/services/ServerUI referencing jline.internal.TerminalLineSettings, an unexpected xvd.service systemd unit, files under /tmp/.xvd or /var/tmp/.xvd, XMRig processes, and traffic to 157.20.241[.]16. Treat any hit as full root compromise of the server.

Who's affected

MSPs and IT teams running N-central on premises or in N-able's hosted environment (Americas, APAC and Europe). Because N-central pushes scripts and software to managed endpoints, a compromised server puts every downstream client network at risk.

✅ Fix / patch

  • If you run N-central on premises, take the server offline now and keep it offline until N-able confirms it is safe to restore, per N-able's guidance.
  • Hosted customers: expect an outage and follow N-able's status page; Ecoverse services under N-able Login (Asset View, Patching, Vulnerability Management, scripting, policies, tagging) stayed online.
  • Apply N-able's hotfix when it ships and only then bring servers back. N-able does not always change version numbers for live hotfixes, so confirm with the vendor rather than by version string.
  • Review N-central logins and audit logs from November 8 onward for new admin accounts, unexpected remote sessions and newly deployed scripts or tools, and check managed client environments if anything is suspicious.

🔎 Quick hunt check

No IOCs have been published by N-able, Huntress or watchTowr in the sources we checked. In earlier N-central exploitation, attackers sprayed downstream environments with unauthorized scripts and tools, so hunt for new N-central admin accounts, unusual logins to the console from November 8 onward, and new scripts or remote-access tools pushed by the N-central agent to managed endpoints.

MITRE ATT&CK: T1190, T1072, T1136, T1552, T1496, T1068

IOCs

  • IP addresses: 157.20.241[.]16
  • Files / paths: /tmp/.xvd, /var/tmp/.xvd, xvd.service (systemd unit)

4EverAble2Shell IOCs reported by Previdian and Huntback via BleepingComputer (Nov 12, 2026). No IOCs published for the original Able2Shell set.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

(index=edr OR index=windows) (parent_process_name IN ("agent.exe","BASupSrvc.exe","NableAgent.exe","N-able*") OR parent_process_path="*\\N-able Technologies\\*")
| search process_name IN ("powershell.exe","pwsh.exe","cmd.exe","rundll32.exe","mshta.exe","msiexec.exe","curl.exe","certutil.exe")
| where _time>=strptime("2026-11-08","%Y-%m-%d")
| stats count min(_time) as first max(_time) as last values(process) as cmd by host, parent_process_name
// Scripts and tools launched by the N-able N-central agent on managed endpoints since Nov 8 (Able2Shell downstream spraying check)
DeviceProcessEvents
| where TimeGenerated >= datetime(2026-11-08)
| where InitiatingProcessFolderPath has "N-able Technologies" or InitiatingProcessFileName in~ ("agent.exe","BASupSrvc.exe")
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","rundll32.exe","mshta.exe","msiexec.exe","curl.exe","certutil.exe")
| summarize Count=count(), First=min(TimeGenerated), Last=max(TimeGenerated), Cmds=make_set(ProcessCommandLine, 25) by DeviceName, InitiatingProcessFileName
| order by Count desc
// Script or tool launches by the N-central agent since Nov 8: review against change tickets for Able2Shell spraying

See all hunt queries →

⏱ CISA deadline

Not in CISA KEV as of Nov 14, 2026.

Sources

Primary source note: N-able's Nov 9 status-dashboard notice (uptime.n-able.com event 202561) is a JavaScript page we could not read; its HF2 blog post is now listed first. 4EverAble2Shell exploitation details come from Previdian and Huntback as reported by BleepingComputer and The Hacker News.

Related playbooks

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →