How to find N-able N-central installations on your network

N-able N-central "Able2Shell" vulnerabilities: #

An independent researcher has publicly disclosed numerous vulnerabilities in N-central under the name "Able2Shell". CVE IDs have not yet been assigned. The researcher reports the following issue classes, among others:

• Unauthenticated XML external entity (XXE) processing in the service-import function, chained with session confusion to achieve remote code execution as the `nable` user on N-central.
• Unauthenticated disclosure of customer asset-discovery database credentials, cross-customer appliance information, and reusable Ecosystem Agent credentials in N-central.
• Unauthenticated overwrite of global configuration and remote-control records in N-central.
• Stored cross-site scripting in the patch metadata view that leads to remote code execution, including as root through the Audit Export function, in N-central.
• Authenticated command injection, file upload path traversal, and stack overflow vulnerabilities that lead to remote code execution, including as root, in N-central.
• Missing authorization checks that allow low-privileged users to create Technician accounts, read appliance registration tokens, and write device configuration in N-central.

The researcher tested N-central appliance version 2026.4.0.31 and states that the issues are expected to affect earlier versions as well. These vulnerabilities have not been confirmed by runZero or by N-able.

N-able has published a status page (ID 202561) about a critical security incident, describing it as a "public disclosure and non-responsible communication of critical vulnerabilities in N-central" found by an independent researcher. The page does not name the researcher, the Able2Shell disclosure, or any specific vulnerabilities, so it is likely, but not confirmed, to be related. N-able reports that it has not seen active exploitation and is developing a hotfix. N-able has taken its hosted N-central environments offline and advises on-premises customers to temporarily take their N-central servers offline until further guidance is provided. Details of the forthcoming fix are not yet available.

The following versions are affected

• N-able N-central: Versions through 2026.4.0.31 are reported as affected; the full range of affected versions has not been confirmed.

What is N-Able N-Central? #

N-able N-central is an enterprise remote monitoring and management (RMM) software platform used by managed service providers (MSPs) and internal IT teams to discover, automate, patch, and secure network infrastructure and endpoints across Windows, macOS, Linux, and cloud environments.

What is the impact? #

Successful exploitation of these vulnerabilities would allow an unauthenticated attacker to gain full administrative control over the platform and access sensitive customer data, potentially facilitating a critical supply-chain compromise across managed client networks.

Are any updates or workarounds available? #

N-able has not yet released a fix, and it is not confirmed that the forthcoming hotfix addresses the Able2Shell vulnerabilities. Monitor the N-able status page for hotfix availability and guidance:

• N-able N-central: Apply the vendor hotfix when it becomes available.

Mitigation:

• Follow N-able's guidance to take on-premises N-central servers offline until N-able confirms they can safely be brought back online.
• Do not expose N-central to the internet or untrusted networks.

How to find potentially vulnerable systems with runZero #

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="N-able" AND product:="N-central" AND source:runzero

September 2026: CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218 #

N-able has disclosed three vulnerabilities in certain versions of N-central.

• CVE-2026-86206: An access control bypass vulnerability in the internal API access control filter allows a remote, unauthenticated attacker to obtain unauthorized access to internal APIs. The vulnerability has been designated CVE-2026-86206 and has been rated medium with a CVSS score of 6.9.
• CVE-2026-86207: An authentication bypass vulnerability in the internal API allows a remote, low-privileged attacker to obtain unauthorized privileges. The vulnerability has been designated CVE-2026-86207 and has been rated high with a CVSS score of 7.7.
• CVE-2026-86218: A pre-authentication remote code execution (RCE) vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the target server. The vulnerability has been designated CVE-2026-86218 and has been rated critical with a CVSS score of 10.0.

There is evidence that CVE-2026-86218 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 8, 2026.

The following versions are affected

• N-Central: Versions prior to 2026.3 Hotfix 4 (Build 2026.3.1.14)

Note: CVE-2026-86218 is resolved in 2026.3 Hotfix 4 (Build 2026.3.1.14), which supersedes 2026.3 Hotfix 3 (Build 2026.3.1.13) (the patch for CVE-2026-86206 and CVE-2026-86207).

What is the impact? #

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to execute arbitrary commands on the target server, potentially enabling persistent lateral movement and unauthorized command execution across managed downstream endpoints.

Are any updates or workarounds available? #

Users are encouraged to update to the latest version as quickly as possible:

• N-central 2025.4.x through 2026.3.x: Upgrade to version 2026.3 Hotfix 4 (Build 2026.3.1.14) or later.
• Legacy and Unsupported Versions: Upgrade to a supported release pathway, then apply version 2026.3 Hotfix 4 (Build 2026.3.1.14).

How to find potentially vulnerable systems with runZero #

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="N-able" AND product:="N-central" AND source:runzero

August 2026: CVE-2026-18556 and CVE-2026-18577 #

N-able has disclosed two vulnerabilities in certain versions of N-central. Certain versions of N-Central are affected by multiple authentication bypass vulnerabilities.

• CVE-2026-18556: Initial authentication bypass via an alternate path or channel. The vulnerability has been designated CVE-2026-18556 and has been rated high with a CVSS score of 8.2.
• CVE-2026-18577: Secondary authentication bypass resulting from an incomplete patch for CVE-2026-18556. The vulnerability has been designated CVE-2026-18577 and has been rated high with a CVSS score of 8.2.

Successful exploitation allows a remote, unauthenticated attacker to bypass authentication and obtain administrative account access on the server. Administrative access may allow attackers to execute unauthorized commands or establish persistence across managed downstream endpoints.

There is evidence that CVE-2026-18577 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 3, 2026.

Update (August 4, 2026): There is evidence that CVE-2026-18556 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 4, 2026.

The following versions are affected

• N-Central: Versions prior to 2026.3.1 Hotfix 1 (Build 2026.3.1.7)

What is the impact? #

Successful exploitation of these vulnerabilities would allow a remote, unauthenticated attacker to bypass authentication and obtain administrative access on the server, potentially enabling unauthorized command execution and persistent lateral movement across managed downstream endpoints.

Are any updates or workarounds available? #

Users are encouraged to update to the latest version as quickly as possible:

• N-central 2026.3.x, 2026.2.x, 2026.1.x, and 2025.4.x: Upgrade to version 2026.3.1 Hotfix 1 (Build 2026.3.1.7) or later.
• Legacy & Unsupported Versions: Upgrade to a supported release pathway, then apply version 2026.3.1 Hotfix 1 (Build 2026.3.1.7).

How to find potentially vulnerable systems with runZero #

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="N-able" AND product:="N-central"

September 2025: CVE-2025-8875 and CVE-2025-8876 #

N-able has disclosed two vulnerabilities in certain versions of N-central. There is evidence that these vulnerabilities are being actively exploited in the wild.

• A deserialization of untrusted data vulnerability allows a remote, low-privileged adversary to execute arbitrary code on the system. This vulnerability has been designated CVE-2025-8875 and has been rated critical with a CVSS score of 9.4.
• An improper input validation vulnerability allows a remote, low-privileged adversary to execute arbitrary OS commands on the system. This vulnerability has been designated CVE-2025-8876 and has been rated critical with a CVSS score of 9.4.

The following versions are affected

• N-central versions prior to 2025.3.1

What is the impact? #

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available? #

Users are encouraged to update to the latest version as quickly as possible:

• N-central upgrade to version 2025.3.1 or later

How to find potentially vulnerable systems with runZero #

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="N-able" product:="N-central"