OverviewOn November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform. In a public disclosure titled Able2Shell, an independent researcher has published details and proof-of-concept (PoC) code covering 33 issues.
Critical vulnerabilities in N-able N-central prompt hosted shutdown
About this summary. This is a short excerpt from the description that Rapid7 published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown
Source attribution: headline and facts are from Rapid7 (rapid7.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Apache HTTP Server patches critical HTTP/2 remote code execution flaw
A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE).
N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
Attackers could exploit the flaws for remote code execution, credential theft, and administrator account creation.
N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains
N-able took N-central offline after 33 critical flaws were disclosed, including chains enabling remote code execution and privilege escalation.
Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Critical flaws impact the Entity List and Field UI modules, and exploit paths exist with contributed modules.
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management…
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10…