# N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline

> On Nov 8, 2026 the GitHub account 'Oracle-Security' (handle BinaryNinja) published write-ups and Python PoC code for 33 alleged vulnerabilities in the N-able N-central RMM platform, including an unauthenticated XXE chained to RCE and privilege escalation to root. N-able took hosted N-central offline, told on-premises customers to shut servers down, and released N-central 2026.4 HF2 on Nov 10, 2026; scanning for vulnerable systems was reported after the PoC appeared.

- **Published:** 2026-11-11T20:37:12Z
- **Last reviewed:** 2026-11-11T20:37:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5794
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5794.png
- **ID:** TL-2026-5794
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10 (3 shown free below)

## Description

On Sunday, November 8, 2026, a GitHub account named 'Oracle-Security', attributed to a researcher using the handle 'BinaryNinja', published a release titled 'Able2Shell' in a repository labelled '0-Days/N-Central N-Able'. The release contains technical write-ups, screenshots, captured output and Python proof-of-concept code for 33 alleged vulnerabilities in N-able N-central, a widely deployed remote monitoring and management (RMM) platform used by managed service providers. N-able described the release as a 'public disclosure and non-responsible communication of critical vulnerabilities'. No CVE identifiers, CVSS scores or affected-version ranges had been assigned to the 33 issues in the sources reviewed, and the claims and PoCs have not been independently verified by N-able, Field Effect or runZero.

The published issues span authenticated and unauthenticated attack paths across multiple components. Per runZero's summary (researcher tested build 2026.4.0.31 and expects earlier versions to be affected), the classes include: an unauthenticated XXE in the service-import function chained with session confusion for remote code execution as the 'nable' user (PoC file anonymous_xxe_nable_rce.py); unauthenticated disclosure of asset-discovery database credentials and reusable Ecosystem Agent credentials; unauthenticated overwrite of global configuration and remote-control records; stored XSS in patch metadata leading to RCE, including as root via Audit Export; authenticated command injection, file-upload path traversal and a stack overflow; and missing authorization checks that let low-privileged users create Technician accounts and read registration tokens. Field Effect additionally lists alleged outcomes such as administrator-account creation, credential disclosure, configuration changes, account enumeration, audit-record manipulation, disruption of remote-control sessions and device impersonation. Previdian told TechTarget the PoC demonstrates a full XXE-to-command-execution chain, and Huntress noted the flaws can be chained to privilege escalation to root.

The risk is amplified by N-central's role: once an attacker holds administrative or root control of the server, legitimate N-central functions (software deployment, script execution, Take Control remote sessions) can be used to reach every managed endpoint. N-central was also the target of real exploitation earlier in 2026: CVE-2026-18556/CVE-2026-18577 (auth bypass, CISA KEV Aug 3-4, followed by abuse of Take Control and Cloudflare tunnels per Huntress/N-able) and CVE-2026-86218 (pre-auth RCE, CVSS 10.0, KEV Sep 8). Those are separate earlier threats and are not part of this record's cve_list, but they show active adversary interest in the product.

Timeline of response: N-able took hosted N-central environments offline and issued a security alert on Nov 9, advised on-premises customers to shut down servers, and stated it had not observed active exploitation. On Nov 10 it released N-central 2026.4 HF2 and reported all hosted environments (NCODs) upgraded. Field Effect's Nov 11 update reports that threat actors began scanning for vulnerable systems after the exploit code appeared; Previdian reported no exploitation attempts on its honeypots as of Nov 9 but expected activity quickly. No threat actor is attributed. Defenders should upgrade to 2026.4 HF2, restrict management-interface exposure, review N-central audit, authentication and automation activity for the period before the shutdown, and rotate N-central administrative, service and integration credentials if unauthorized activity is found.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1098 Account Manipulation
- T1552 Unsecured Credentials
- T1219 Remote Access Tools
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Able2Shell N-central XXE-to-RCE: Shell or Downloader Executed by 'nable' Service Account (TL-2026-5794)** (`TL-2026-5794-SPL-001`)

Behaviour-first detection of the post-exploit outcome of the Able2Shell unauthenticated XXE + session-confusion chain against N-able N-central (TL-2026-5794): command execution as local user 'nable' on the N-central server. Fires when the nable service account executes a shell, scripting interpreter or network downloader (sh, bash, python, perl, curl, wget, nc, socat). A web-tier service account launching interpreters is rare and is the observable result of RCE via the public anonymous_xxe_nable_rce.py PoC.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059
- **Data sources:** linux_audit, auditd, ncentral_server
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=linux sourcetype="linux_audit" type=SYSCALL syscall=59 success=yes (UID="nable" OR uid="nable")
```TL-2026-5794 Able2Shell XXE-to-RCE: shell, interpreter or downloader executed by the nable service account on the N-central server (T1190/T1059)```
| search exe IN ("*/bin/sh","*/bin/bash","*/bin/dash","*/curl","*/wget","*/python*","*/perl","*/nc","*/ncat","*/socat")
| stats count min(_time) as first_seen max(_time) as last_seen values(exe) as executed values(comm) as comm values(ppid) as parent_pids by host
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
// TL-2026-5794 Able2Shell: web-tier process spawning shell/downloader as 'nable'
DeviceProcessEvents
| where Timestamp > ago(24h)
| where AccountName =~ "nable"
| where InitiatingProcessFileName in~ ("java", "httpd", "apache2", "nginx", "tomcat")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "python", "python3", "perl", "nc", "ncat", "socat")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: N-central Able2Shell - Shell or Downloader Spawned by nable Service Account
id: 5d1c7a42-8b3e-4f6a-9c10-2e7b4a9d1f01
status: experimental
description: Detects the N-able N-central web tier (java/httpd) running as user nable spawning a shell, interpreter or downloader, the reported outcome of the Able2Shell XXE-to-RCE chain (TL-2026-5794).
references:
    - https://www.runzero.com/blog/n-able-n-central/
    - https://fieldeffect.com/blog/n-central-offline-alleged-zero-days
    - https://huntress.com/blog/n-able-vulnerability-exploitation
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: linux
detection:
    selection_user:
        User: 'nable'
    selection_parent:
        ParentImage|endswith:
            - '/java'
            - '/httpd'
            - '/apache2'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/python'
            - '/python3'
            - '/perl'
            - '/nc'
            - '/ncat'
            - '/socat'
    condition: selection_user and selection_parent and selection_child
falsepositives:
    - Legitimate N-central maintenance or upgrade scripts run by the nable account
    - Administrator troubleshooting under su/sudo into nable
level: high

```

**Known false positives:**

- Scheduled N-central maintenance, backup or upgrade scripts executing bash as nable
- Administrators using su - nable for troubleshooting

**Tuning notes:** Baseline the shells/interpreters nable runs during normal patch windows and allow-list those by exe+ppid. Requires auditd execve rules (-a always,exit -F arch=b64 -S execve) with ENRICHED UID names on the N-central server; adjust the UID field name to your TA. Prioritise hits after unexplained Take Control/automation activity or inside the pre-2026.4 HF2 exposure window.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- N-central Pre-Auth Probing: getPierDetails and Unauthenticated Import POSTs (Able2Shell scanning) TL-2026-5794 (locked: unlock with TL Creds)
- N-central Server Credential Harvesting by Web-Tier Account (Able2Shell credential disclosure) TL-2026-5794 (locked: unlock with TL Creds)
- Cloudflared Tunnel Persistence and Known N-central Actor Infrastructure on Endpoints TL-2026-5794 (locked: unlock with TL Creds)
- Able2Shell PoC Tooling Execution or Staging: [indicator] / Oracle-Security Repository (TL-2026-5794) (locked: unlock with TL Creds)
- N-central Root Shell from Web Tier and Audit/Log Tampering (Able2Shell privesc, Audit Export) TL-2026-5794 (locked: unlock with TL Creds)
- Scripting or Download Tools Launched by Take Control Agent - RMM Pivot to Managed Endpoints TL-2026-5794 (locked: unlock with TL Creds)
- N-central New Technician/Admin Account or Role Change - '.invalid' Email Artifact (Able2Shell) TL-2026-5794 (locked: unlock with TL Creds)
- N-central Take Control Remote Session with 'MSP Support' User on Endpoint (Able2Shell abuse of RMM) TL-2026-5794 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 10)

Defanged, TLP:CLEAR.

- IP address: `173.249.252[.]200`
- Domain: `mousears[.]synology[.]me`
- IP address: `87.249.138[.]34`

Full set of 10 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [N-able takes N-central platform offline after zero-day dump](https://www.techtarget.com/news/n-able-takes-n-central-platform-offline-after-zero-day-dump/874195/)
- [N-able takes N-central offline as alleged zero-day exploits surface (Field Effect, updated 2026-11-11)](https://fieldeffect.com/blog/n-central-offline-alleged-zero-days)
- [runZero: Latest N-able N-central vulnerabilities (Able2Shell section, updated 2026-11-09)](https://www.runzero.com/blog/n-able-n-central/)
- [Huntress: Rapid Response - Critical N-able N-central Vulnerability and Active Exploitation (earlier 2026 N-central exploitation, IOCs)](https://huntress.com/blog/n-able-vulnerability-exploitation)
- [N-able security alert / uptime page](https://uptime.n-able.com/)
- [CISA Known Exploited Vulnerabilities Catalog (earlier N-central CVEs)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5794