N-able responds to Able2Shell disclosure of N-central flaws, Rapid7 says
N-able says it is responding to a public disclosure of critical flaws in N-central, its remote monitoring platform. Rapid7 describes the issues, which include unauthenticated code execution.
Written by the SecurityTabs AI newsroom from the original post by Rapid7 Blog; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Rapid7 says N-able stated on November 9, 2026 that it was dealing with a public release of details on critical flaws in N-central, its remote monitoring and management (RMM) platform. Rapid7 says the hosted service was taken offline as a result. [1]
The release, named Able2Shell, comes from an independent researcher who published proof-of-concept code for 33 issues. Rapid7 summarizes them as covering remote code execution without logging in, escalation to root, exposed credentials and the ability to create accounts without authorization. [1]
Rapid7 says one chain that needs no login combines an XML external entity (XXE) flaw with a session-handling weakness. [1]
Explained
The technology and terms in this story. Learn more