Most advisories say patch now . This one says turn it off .

On November 9, N-able took hosted N-central offline and told every on-prem customer to shut down their servers entirely until further notice . No workaround, no patch, no CVE IDs.

The trigger: researcher Sean Bales published 33 zero-days on GitHub with working PoC code and a video demo. The disclosure is called Able2Shell .

The worst chain

Unauthenticated XXE in service-import → steal a local session → reset a password → RCE as nable → create a persistent admin account with attacker-chosen credentials .

No login required. The account survives a restart and looks legitimate in the logs.

Why it's worse than a typical vuln

N-central is an RMM. It patches, deploys software, and opens remote shells across every client an MSP manages. The blast radius isn't the server — it's every endpoint downstream.

This is also N-central's fifth emergency cycle since August . CVE-2026-86218 (pre-auth RCE, CVSS 10.0) was in CISA KEV.…