Able2Shell FAQ: N-able N-central Zero-Days and Hotfix 2
N-able released a hotfix for N-central that fixes seven CVEs after a researcher published proof-of-concept code for 33 alleged zero-day vulnerabilities. The researcher says one attack chain needs no credentials. Key Takeaways Able2Shell is a set of 33 alleged vulnerabilities in N-able N-central, published with proof-of-concept code. The researcher says one chain lets an unauthenticated attacker run commands on the server. Security firms report exploitation attempts against N-central honeypots, but as of November 10, no confirmed compromise of a customer server has been reported. N-able released N-central 2026.4 Hotfix 2 on November 10. It fixes seven CVEs. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding Able2Shell, a set of reported zero-day vulnerabilities in N-able N-central. FAQ When was Able2Shell first disclosed? A researcher operating under the GitHub account “Oracle-Security” published a write-up titled “Able2Shell” in the account’s CVEs repository. It describes 33 alleged N-central vulnerabilities with proof-of-concept code. The earliest README commit is dated November 9, 2026 at 04:14 UTC. N-able described the release as a public disclosure by an independent security researcher. N-able does not state whether it was notified in advance and does not name the researcher. What are the v...
Entenda a falha
A vulnerabilidade
N-central 2026.4 Hotfix 2 (build 2026.4.1.26) fixes seven CVEs; N-able lists versions before 26.4.1 as affected. By CVSSv4: CVE-2026-125883 (XXE, 9.3, no privileges or user interaction) and CVE-2026-125881 (SSRF via service import schema validation, 9.3). Then CVE-2026-125878 (OGNL injection, 8.7), CVE-2026-125879 (local root via a nable-writable syslog-ng config, 8.6) and CVE-2026-125882 (RCE via file repository upload path traversal, 8.6). Then CVE-2026-91000 (insecure IPC channels, local privilege escalation, 8.4) and CVE-2026-125880 (stored XSS via MMS3 patch metadata, 8.3, needs an admin to view it). The researcher claims one chain gives an unauthenticated attacker commands on the server; the other flaws need an admin, a login or local access.
Como funciona
In the chain the researcher calls credential-free, the attacker submits a service import to the appliance, and the XML processing resolves external entities. The appliance then fetches a file from a server the attacker hosts, and this step leads to commands running as the nable account (uid 992). In the MMS3 chains, a script planted in patch metadata runs when a logged-in administrator opens the poisoned patch details, and that can lead to OGNL execution or to root through Audit Export. A separate chain uses a file path traversal to reach a syslog installer and gain root, and it requires login.
Por que é vulnerável
The CVE titles point to classic missing-validation errors: XML parsers that accept external entities, schema hints that trigger server-side requests, user-controlled data reaching OGNL evaluation, upload paths that are not constrained, patch metadata that is not sanitized, a syslog-ng configuration the low-privilege nable account can write, and IPC channels without proper protection. The articles do not give the exact root cause of each CVE, and N-able has not said which of the 33 findings each CVE covers. The fix is in Hotfix 2, and N-able says a follow-up hotfix will bring more security updates.
Onde está
The articles name components, not code: service import schema validation, file repository upload, MMS3 patch metadata, the syslog-ng config and IPC channels, plus the researcher's README in the Oracle-Security CVEs repository on GitHub.
Como foi descoberta
A researcher using the GitHub account Oracle-Security published the Able2Shell write-up, describing 33 alleged zero-days with PoC code. The earliest README commit is dated November 9, 2026 at 04:14 UTC. N-able calls it a public disclosure by an independent researcher and does not say whether it was notified in advance. N-able credits CVE-2026-125882 to Nate Fair of Sprocket Security, and CVE-2026-91000 had been reserved on September 14, before the disclosure. N-able published the seven CVEs and the hotfix on November 10.
PoC pública
The researcher's README includes Python proof-of-concept code for the alleged flaws, tested against N-central Appliance 2026.4.0.31, a build the researcher calls pre-release. It covers four exploit chains, and the PoC for the XXE chain can also create an administrator account. N-able reports scanning activity tied to the published PoC, and Previdian and watchTowr saw exploitation attempts against honeypots. As of November 10, no confirmed compromise of a customer server had been reported. Because the code is public, patch on-premises servers quickly.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 03:15.
Linha do tempo
-
Able2Shell FAQ: N-able N-central Zero-Days and Hotfix 2
ler a análise desta fonte ocultar
N-able released a hotfix for N-central that fixes seven CVEs after a researcher published proof-of-concept code for 33 alleged zero-day vulnerabilities. The researcher says one attack chain needs no credentials. Key Takeaways Able2Shell is a set of 33 alleged vulnerabilities in N-able N-central, published with proof-of-concept code. The researcher says one chain lets an unauthenticated attacker run commands on the server. Security firms report exploitation attempts against N-central honeypots, but as of November 10, no confirmed compromise of a customer server has been reported. N-able released N-central 2026.4 Hotfix 2 on November 10. It fixes seven CVEs. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding Able2Shell, a set of reported zero-day vulnerabilities in N-able N-central. FAQ When was Able2Shell first disclosed? A researcher operating under the GitHub account “Oracle-Security” published a write-up titled “Able2Shell” in the account’s CVEs repository. It describes 33 alleged N-central vulnerabilities with proof-of-concept code. The earliest README commit is dated November 9, 2026 at 04:14 UTC. N-able described the release as a public disclosure by an independent security researcher. N-able does not state whether it was notified in advance and does not name the researcher. What are the v...