N-able N-central: Able2Shell zero-day flaws disclosed, hotfixes released (fixed in 2026.4.1.26)
CVE-2021-44228 CVE-2026-18556 CVE-2026-18577 CVE-2026-86206 CVE-2026-86207 CVE-2026-86218
Published 09/11/2026 22:59 · Updated 11/11/2026 19:14 (revision 2)
Timeline
5 events over 2 d
- 09/11/2026 18:47UnconfirmedCommunity post+7 min
- 09/11/2026 18:55CorroboratedCommunity post+3 h
- 09/11/2026 22:00ConfirmedHuntress blog+59 min
- 09/11/2026 22:59Published on WatchtowerPro CISO+1 d 20 h
- 11/11/2026 19:14UpdatedBleepingComputer reports that N-able has released security hotfixes for the Able2Shell…
In short
An independent researcher published details of about 33 zero-day flaws in N-able N-central, chained into exploits nicknamed Able2Shell. N-able took its hosted cloud environments offline and has now released hotfixes. NCSC-NL says versions older than 2026.4.1.26 are affected. On-premises customers should install the hotfix or update as soon as possible. Shodan recognises at least 1,597 internet-facing N-able N-central servers worldwide, 202 of them in the EU (11/11/2026); the real number is likely higher, and how many run an affected version is not yet known.
How bad is it
Critical. An attacker who can reach a vulnerable N-central server may be able to run their own code on it, in several chains without logging in, and then control the computers it manages.
Being exploited - on CISA's known-exploited list since 10/12/2021.
Severity score
The worst of 6 CVEs · CVSS 3.1 from NVD, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- According to NCSC-NL, N-able N-central versions older than 2026.4.1.26 are affected. The researcher tested N-central Appliance 2026.4.0.31 (a pre-release version) and says earlier versions are likely affected too.
- CVE-2026-86218 (pre-authentication remote code execution) affects versions before 2026.3.1.14; Hotfix 4 (2026.3 HF4) is the mandatory baseline for on-premises instances.
Fixed in
- N-central 2026.4.1.26 and later, according to NCSC-NL. BleepingComputer reports that N-able has released hotfixes for the Able2Shell zero-days; check N-able's advisory for the hotfix for your branch.
What to do now
- On-premises: install N-able's hotfix or update to 2026.4.1.26 or later as soon as possible, following N-able's advisory. Until then, keep the server offline or not reachable from the internet.
- Review login and authentication activity from 08/11/2026 onward. Look for unusual remote sessions, new scripts being deployed and new administrator accounts.
- Hosted customers: follow N-able's status page.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer, all 4 sources with their dates and every revision. And technology matching: which of your systems run N-able N-central, at which version, fixed or not - and what each one needs.
Main sources
N-able Disables Cloud Services Following Disclosure of "Able2Shell" Exploit Chains Research · NCSC-2026-0342 Kwetsbaarheid verholpen in N-central van N-able Research · watchTowr Community