N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5794 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Able2Shell N-central XXE-to-RCE: Shell or Downloader Executed by 'nable' Service Account (TL-2026-5794)

Behaviour-first detection of the post-exploit outcome of the Able2Shell unauthenticated XXE + session-confusion chain against N-able N-central (TL-2026-5794): command execution as local user 'nable' on the N-central server. Fires when the nable service account executes a shell, scripting interpreter or network downloader (sh, bash, python, perl, curl, wget, nc, socat). A web-tier service account launching interpreters is rare and is the observable result of RCE via the public anonymous_xxe_nable_rce.py PoC.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059
• Data sources: linux_audit, auditd, ncentral_server
• Severity: high
• Confidence: medium

Splunk SPL

index=linux sourcetype="linux_audit" type=SYSCALL syscall=59 success=yes (UID="nable" OR uid="nable")
```TL-2026-5794 Able2Shell XXE-to-RCE: shell, interpreter or downloader executed by the nable service account on the N-central server (T1190/T1059)```
| search exe IN ("*/bin/sh","*/bin/bash","*/bin/dash","*/curl","*/wget","*/python*","*/perl","*/nc","*/ncat","*/socat")
| stats count min(_time) as first_seen max(_time) as last_seen values(exe) as executed values(comm) as comm values(ppid) as parent_pids by host
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// TL-2026-5794 Able2Shell: web-tier process spawning shell/downloader as 'nable'
DeviceProcessEvents
| where Timestamp > ago(24h)
| where AccountName =~ "nable"
| where InitiatingProcessFileName in~ ("java", "httpd", "apache2", "nginx", "tomcat")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "python", "python3", "perl", "nc", "ncat", "socat")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: N-central Able2Shell - Shell or Downloader Spawned by nable Service Account
id: 5d1c7a42-8b3e-4f6a-9c10-2e7b4a9d1f01
status: experimental
description: Detects the N-able N-central web tier (java/httpd) running as user nable spawning a shell, interpreter or downloader, the reported outcome of the Able2Shell XXE-to-RCE chain (TL-2026-5794).
references:
    - https://www.runzero.com/blog/n-able-n-central/
    - https://fieldeffect.com/blog/n-central-offline-alleged-zero-days
    - https://huntress.com/blog/n-able-vulnerability-exploitation
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: linux
detection:
    selection_user:
        User: 'nable'
    selection_parent:
        ParentImage|endswith:
            - '/java'
            - '/httpd'
            - '/apache2'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/python'
            - '/python3'
            - '/perl'
            - '/nc'
            - '/ncat'
            - '/socat'
    condition: selection_user and selection_parent and selection_child
falsepositives:
    - Legitimate N-central maintenance or upgrade scripts run by the nable account
    - Administrator troubleshooting under su/sudo into nable
level: high

Known false positives:

• Scheduled N-central maintenance, backup or upgrade scripts executing bash as nable
• Administrators using su - nable for troubleshooting

Tuning notes: Baseline the shells/interpreters nable runs during normal patch windows and allow-list those by exe+ppid. Requires auditd execve rules (-a always,exit -F arch=b64 -S execve) with ENRICHED UID names on the N-central server; adjust the UID field name to your TA. Prioritise hits after unexplained Take Control/automation activity or inside the pre-2026.4 HF2 exposure window.

• 🔒 N-central Pre-Auth Probing: getPierDetails and Unauthenticated Import POSTs (Able2Shell scanning) TL-2026-5794 · unlock with TL Creds
• 🔒 N-central Server Credential Harvesting by Web-Tier Account (Able2Shell credential disclosure) TL-2026-5794 · unlock with TL Creds
• 🔒 Cloudflared Tunnel Persistence and Known N-central Actor Infrastructure on Endpoints TL-2026-5794 · unlock with TL Creds
• 🔒 Able2Shell PoC Tooling Execution or Staging: [indicator] / Oracle-Security Repository (TL-2026-5794) · unlock with TL Creds
• 🔒 N-central Root Shell from Web Tier and Audit/Log Tampering (Able2Shell privesc, Audit Export) TL-2026-5794 · unlock with TL Creds
• 🔒 Scripting or Download Tools Launched by Take Control Agent - RMM Pivot to Managed Endpoints TL-2026-5794 · unlock with TL Creds
• 🔒 N-central New Technician/Admin Account or Role Change - '.invalid' Email Artifact (Able2Shell) TL-2026-5794 · unlock with TL Creds
• 🔒 N-central Take Control Remote Session with 'MSP Support' User on Endpoint (Able2Shell abuse of RMM) TL-2026-5794 · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5794.

Sample indicators (3 of 10)

• IP address: 173.249.252[.]200
• Domain: mousears[.]synology[.]me
• IP address: 87.249.138[.]34

Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.

Technical analysis

On Sunday, November 8, 2026, a GitHub account named 'Oracle-Security', attributed to a researcher using the handle 'BinaryNinja', published a release titled 'Able2Shell' in a repository labelled '0-Days/N-Central N-Able'. The release contains technical write-ups, screenshots, captured output and Python proof-of-concept code for 33 alleged vulnerabilities in N-able N-central, a widely deployed remote monitoring and management (RMM) platform used by managed service providers. N-able described the release as a 'public disclosure and non-responsible communication of critical vulnerabilities'. No CVE identifiers, CVSS scores or affected-version ranges had been assigned to the 33 issues in the sources reviewed, and the claims and PoCs have not been independently verified by N-able, Field Effect or runZero.

The published issues span authenticated and unauthenticated attack paths across multiple components. Per runZero's summary (researcher tested build 2026.4.0.31 and expects earlier versions to be affected), the classes include: an unauthenticated XXE in the service-import function chained with session confusion for remote code execution as the 'nable' user (PoC file anonymous_xxe_nable_rce.py); unauthenticated disclosure of asset-discovery database credentials and reusable Ecosystem Agent credentials; unauthenticated overwrite of global configuration and remote-control records; stored XSS in patch metadata leading to RCE, including as root via Audit Export; authenticated command injection, file-upload path traversal and a stack overflow; and missing authorization checks that let low-privileged users create Technician accounts and read registration tokens. Field Effect additionally lists alleged outcomes such as administrator-account creation, credential disclosure, configuration changes, account enumeration, audit-record manipulation, disruption of remote-control sessions and device impersonation. Previdian told TechTarget the PoC demonstrates a full XXE-to-command-execution chain, and Huntress noted the flaws can be chained to privilege escalation to root.

The risk is amplified by N-central's role: once an attacker holds administrative or root control of the server, legitimate N-central functions (software deployment, script execution, Take Control remote sessions) can be used to reach every managed endpoint. N-central was also the target of real exploitation earlier in 2026: CVE-2026-18556/CVE-2026-18577 (auth bypass, CISA KEV Aug 3-4, followed by abuse of Take Control and Cloudflare tunnels per Huntress/N-able) and CVE-2026-86218 (pre-auth RCE, CVSS 10.0, KEV Sep 8). Those are separate earlier threats and are not part of this record's cve_list, but they show active adversary interest in the product.

Timeline of response: N-able took hosted N-central environments offline and issued a security alert on Nov 9, advised on-premises customers to shut down servers, and stated it had not observed active exploitation. On Nov 10 it released N-central 2026.4 HF2 and reported all hosted environments (NCODs) upgraded. Field Effect's Nov 11 update reports that threat actors began scanning for vulnerable systems after the exploit code appeared; Previdian reported no exploitation attempts on its honeypots as of Nov 9 but expected activity quickly. No threat actor is attributed. Defenders should upgrade to 2026.4 HF2, restrict management-interface exposure, review N-central audit, authentication and automation activity for the period before the shutdown, and rotate N-central administrative, service and integration credentials if unauthorized activity is found.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Persistence

T1098 Account Manipulation; T1136 Create Account

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Command and Control

T1219 Remote Access Tools

Credential Access

T1552 Unsecured Credentials

Impact

T1565 Data Manipulation

Resource Development

T1588.005 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

• N-central 2026.4 HF2 (released 2026-11-10); hosted NCOD environments upgraded in all regions

Immediate actions

• Upgrade on-premises N-central to 2026.4 HF2 (released 2026-11-10) following N-able's published upgrade guidance; keep servers offline until upgraded
• Check whether N-central management interfaces are reachable from the internet and restrict them to dedicated admin networks/VPN
• Review N-central authentication events, admin account creation, privilege/role changes, configuration edits, software deployments, script execution, remote-control sessions and automation policy changes for the period before shutdown
• Monitor managed endpoints for deployments, scripts, Take Control sessions and configuration changes originating from N-central

Workarounds

• Shut down on-premises N-central servers until patched, as advised by N-able
• Rotate N-central administrative, service-account and integration credentials if unauthorized activity is found

Longer-term hardening

• Map N-central trust relationships (stored admin credentials, service accounts, API integrations, access to domain controllers, virtualization, backup, identity providers and security tools)
• Enforce MFA and IP allow-listing for the N-central console
• Alert on new Technician/admin accounts, '.invalid' email addresses and unexpected remote-control activity

Affected and fixed versions

• N-able — N-central
  Vulnerable versions: 2026.4.0.31 (tested by researcher; earlier versions expected affected, full range unconfirmed)
  Fixed in: 2026.4 HF2

Timeline

• 2026-08-03 Earlier N-central auth-bypass CVE-2026-18577 (and CVE-2026-18556) added to CISA KEV (Aug 3-4) after exploitation in July/August 2026; separate prior threat, shows adversary interest in N-central.
• 2026-09-08 CVE-2026-86218 (pre-auth RCE, CVSS 10.0) added to CISA KEV; fixed in 2026.3 HF4. Separate earlier threat.
• 2026-11-08 GitHub account 'Oracle-Security' (handle BinaryNinja) publishes the 'Able2Shell' release with write-ups, screenshots and Python PoC code for 33 alleged N-central vulnerabilities.
• 2026-11-09 Previdian, Huntress, Field Effect and runZero publish analysis; Previdian reports no honeypot exploitation yet but expects it quickly.
• 2026-11-09 N-able takes hosted N-central offline, issues a security alert citing 'non-responsible communication of critical vulnerabilities', advises on-premises customers to shut servers down, and states no active exploitation observed.
• 2026-11-10 N-able releases N-central 2026.4 HF2 and reports all hosted (NCOD) environments in all regions upgraded.
• 2026-11-11 Field Effect update reports threat actors began scanning for vulnerable N-central systems after the exploit code appeared; claims and PoCs remain unverified.

Sources cited

• N-able takes N-central offline as alleged zero-day exploits surface (Field Effect, updated 2026-11-11) fieldeffect.com · Advisory · 2026-11-09
• CISA Known Exploited Vulnerabilities Catalog (earlier N-central CVEs) CISA · Government advisory · 2026-09-08
• runZero: Latest N-able N-central vulnerabilities (Able2Shell section, updated 2026-11-09) runzero.com · Research · 2026-11-09
• Huntress: Rapid Response - Critical N-able N-central Vulnerability and Active Exploitation (earlier 2026 N-central exploitation, IOCs) Huntress · Research · 2026-09-06
• N-able security alert / uptime page uptime.n-able.com · Vendor report · 2026-11-09
• N-able takes N-central platform offline after zero-day dump techtarget.com · News · 2026-11-09

More in vulnerability

• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)

Further reading

• Axios Supply Chain Attack: Cross-Platform RATs