# N-able N-central November 2026 disclosure: detection pack

Critical vulnerabilities in the N-able N-central server (the RMM platform MSPs use to manage client devices)
were publicly disclosed by an independent security researcher. N-able has now released N-central 2026.4
Hotfix 2 and published seven related CVEs.

> **Status of this pack.** The KQL in `kql/` and the converted Sigma in `sigma/converted/` have NOT been run against a
> live Sentinel or Defender tenant. Test and tune them before you rely on them. The KQL parses cleanly against the
> table schemas we model, which is not the same as running it. N-able has published no indicators of compromise.
> Every hunting pattern here is our own. Items not confirmed by N-able are marked [UNVERIFIED] or
> [UNVERIFIED - researcher claim].

## Where things stand (checked 10 Nov 2026, 22:27 GMT)

Official sources: N-able Uptime incident (https://uptime.n-able.com/, API dashboard data fetched 22:27 GMT) and
the N-central 2026.4 HF2 release notes (https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/,
posted 10 November 2026, last updated 10 November 2026).

| Item | Value | Source |
|---|---|---|
| Vendor incident | "N-central Critical Security Incident - Release Available". Status Monitoring. Severity "Major Outage". Start listed as 2026-11-09T14:00:00. | N-able Uptime (22:27 GMT, 10 Nov) |
| Latest official wording | N-able is responding to the public disclosure of critical vulnerabilities by an independent security researcher. "We are now observing scanning activity associated with the published proof-of-concept code." "We continue to recommend that N-central servers remain offline until your server has been successfully upgraded." | N-able Uptime (22:27 GMT) |
| Fix | N-central 2026.4 HF2, build 2026.4.1.26, "critical security update." HF2 supersedes 2026.4 (2026.4.0.27) and HF1 (2026.4.0.32). N-able also says a follow-up hotfix will be released for further security updates. | HF2 release notes and Uptime |
| On-premises | N-able strongly recommends upgrade to 2026.4.1.26 as soon as possible. Keep the server offline until it has been successfully upgraded. | Uptime and HF2 notes |
| Hosted (NCOD) | All hosted regions, including trials, are being upgraded. Access is restored as each region completes upgrade and validation. Hosted was previously taken offline as a precaution. Hosted customers must still upgrade Agents and Probes (Agents first, then Probes). | Uptime and HF2 notes |
| Upgrade path | Supported upgrade from 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 HF1-4, 2026.4 and HF1. Earlier releases: upgrade to a supported version first. | HF2 release notes |
| Known issue | Built-in remote control is temporarily disabled after HF2; Take Control still works. | HF2 release notes |
| CVEs | Seven published: CVE-2026-125883 (XXE); CVE-2026-125878 (OGNL injection); CVE-2026-125879 (local privilege escalation via nable-writable syslog-ng config); CVE-2026-125880 (stored XSS via MMS3 patch metadata, admin context); CVE-2026-125881 (schema-hint SSRF via service import); CVE-2026-125882 (RCE via file repository upload path traversal); CVE-2026-91000 (insecure IPC, local privilege escalation). Credited to security researchers; we do not name them. | Uptime and HF2 notes |
| CISA KEV | None of these seven CVEs, and not "Able2Shell" as a name, is in KEV catalogue 2026.11.10 (released 2026-11-10T19:03:29.8375Z). Older N-central CVEs remain in the catalogue. | CISA KEV JSON (22:27 GMT) |
| Checker fixed builds | `FIXED_BUILDS` is still empty in the shipped checkers. N-able has named server build 2026.4.1.26, but a follow-up hotfix is also planned, and hosted/on-prem customers must still upgrade Agents and Probes. Add 2026.4.1.26 yourself if you want a FIXED BUILD verdict for that server build. Confirm the installed build against N-able's release notes. | This pack |

N-able's own words call these critical vulnerabilities. This pack does not invent CVSS scores.

Able2Shell is the public name used at disclosure. The official remediation is now the seven CVEs and 2026.4 HF2.
We do not link any proof-of-concept repository.

## What to do now

**N-able's advice (vendor):**

1. On-premises: upgrade servers to 2026.4.1.26 as soon as possible. Keep each server offline until it has been
   successfully upgraded. Follow the HF2 release notes, including the Agent and Probe upgrade order (Agents first,
   then Probes) and the supported upgrade path.
2. Hosted (NCOD): N-able is upgrading the hosted servers. You must still upgrade Agents and Probes. Access returns
   as each region completes upgrade and validation.
3. Watch [Uptime](https://uptime.n-able.com/) and the [HF2 release notes](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/)
   for the follow-up hotfix and any further guidance.

**Our advice (not from N-able):**

1. Find every N-central server you or your clients run, internet facing ones first (KQL Q1 to Q1d, checker CSV mode).
   If a server cannot be upgraded at once, remove all internet exposure now and keep it offline until it is upgraded.
2. Plan a fallback way to reach clients while the RMM is down: a separate remote access tool or VPN, out of band
   admin accounts that do not depend on N-central, and an agreed client contact path.
3. Hunt from 8 Nov 2026 on the server and on managed endpoints (below), including the period before the server
   went offline. Taking a server offline, or upgrading it, does not undo earlier activity.
4. After upgrade, confirm the installed build is 2026.4.1.26 against N-able's release notes, not the marketing
   version string alone. Upgrade Agents and Probes. Add 2026.4.1.26 to `FIXED_BUILDS` in both checkers if you want
   the reserved FIXED BUILD verdict.
5. Rotate N-central credentials (all admin and technician accounts, API and integration accounts) before bringing
   the server back to normal use.

**If you find signs of compromise (our advice):** isolate the server, keep its logs and a disk image, rotate N-central
credentials and every client credential it stores or could reach, and start incident response for every client the
server manages, since an attacker with control of N-central can push scripts and tools to all of them.

## Contents

| Path | What it is |
|---|---|
| `kql/n-able-ncentral-able2shell-hunting.kql` | Q1 to Q1d inventory and exposure; Q2, Q2b web requests to legacy SOAP and applianceLog paths; Q3 audit records (Default Administrator, credential changes, accounts created or enabled); Q4, Q4b processes as nable or root on the server; Q5 file writes in web folders; Q6 to Q6e managed endpoints (agent launched scripts and tools versus a 30 day baseline, second hop, new files, new local accounts, new remote access tools) |
| `sigma/*.yml` | 6 rules: agent spawning script interpreters (windows process_creation), agent child adding users or downloading (windows process_creation), shell as nable (linux process_creation), JSP or script written under web folders (linux file_event), applianceLog request (webserver), legacy UI SOAP request (webserver) |
| `sigma/converted/` | Kusto output for no pipeline, microsoft_xdr, microsoft_365_defender, sentinel_asim and azure_monitor |
| `scripts/check-ncentral.sh`, `scripts/Check-NCentral.ps1` | Read-only offline checkers with identical output and exit codes |
| `tests/` | Bash tests, Pester tests (including bash vs PowerShell parity), synthetic fixtures, `run_all.sh` |

### Sigma conversion (sigma-cli 3.1.0, pySigma Kusto backend)

`sigma check`: 0 errors, 0 condition errors, 0 issues.

* The two Windows rules convert on every pipeline. `microsoft_xdr` and `microsoft_365_defender` map them to
  `DeviceProcessEvents` (ParentImage becomes `InitiatingProcessFolderPath`); `sentinel_asim` maps to `imProcessCreate`;
  `azure_monitor` maps to `SecurityEvent` (needs process creation event 4688 with command line logging).
* The two Linux rules convert on every pipeline. `microsoft_xdr` and `microsoft_365_defender` map them to
  `DeviceProcessEvents` and `DeviceFileEvents`; `sentinel_asim` maps them to `imProcessCreate` and `imFileEvent`.
  Caveat: `azure_monitor` maps them to `SecurityEvent`, a Windows table, so that output is not usable for Linux hosts.
  They also need a Linux sensor on the N-central appliance, which many MSPs will not have.
* The two webserver rules fail on `microsoft_xdr`, `microsoft_365_defender` and `azure_monitor` ("Unable to determine
  table name from rule") and on `sentinel_asim` (`cs-uri-stem` is not a supported field). They convert only without a
  pipeline, as bare field expressions you must point at your own table. Use KQL Q2 and Q2b instead.

## Hunting notes (our patterns, not N-able indicators)

**On the N-central server**

* Web requests (Q2, Q2b, checker `--log`). [UNVERIFIED - public research] Published research on earlier N-central
  flaws (CVE-2025-9316, CVE-2025-11700) used the legacy SOAP services `/dms/services/ServerMMS` and
  `/dms/services/ServerUI` (and `/dms2/services2/ServerMMS2`, `ServerUI2`) and wrote content to
  `/opt/nable/webapps/ROOT/applianceLog/`. News summaries of Able2Shell describe an anonymous MMS2 session, service
  import XXE and a JSP file being written and run. Agents talk to the MMS service all day, so our signals are one
  source getting 2xx from both MMS and UI services, and any request under `/applianceLog/`. Access logs do not show
  the SOAP method or body, so these are leads, not proof.
* Accounts (Q3, checker `--audit`). Look for "Default Administrator" being created or enabled [news], credential changes
  nobody asked for, and new or re-enabled admin accounts from 8 Nov. [UNVERIFIED] N-central audit export and syslog
  wording vary; the checker and Q3 use simple keywords.
* Processes (Q4, Q4b). Unexpected shells or tools run as `nable` or root [UNVERIFIED - researcher claim, via news].
* Files (Q5). New `.jsp`, `.jspx`, `.war`, `.class` or scripts under `/opt/nable/webapps/` or `applianceLog`
  [UNVERIFIED - public research for the paths].

**On managed endpoints (where most MSPs have Defender)**

* Q6 lists scripts and tools launched by the N-central Windows Agent (`agent.exe` or `AgentMaint.exe` in
  `\N-able Technologies\Windows Agent\bin\`, per N-able documentation) since 8 Nov that do not match anything the agent
  ran in the 30 days before. Q6b looks one hop further (agent > cmd > tool). Q6c lists new executables and scripts
  written by the agent tree. Q6d lists new local accounts. Q6e lists remote access tools new to a device.
  [UNVERIFIED - community RMM catalogue] MSP Agent (`msp-agent-core.exe`) and Take Control helper names.
* N-able says hosted N-central has been offline since 15:15 UTC on 9 Nov, while Ecoverse scripting stays up. So
  agent driven activity after that time should map to an on-premises server or an Ecoverse job you ran.

## Checkers

Strictly read-only. They read files you supply and their arguments; they do not contact N-central, open sockets, run
other programs or write files. No payloads. They never report a build as patched: no fix exists yet, and
`FIXED_BUILDS` (bash) and `$FixedBuilds` (PowerShell) are empty on purpose. When N-able names a fixed build, add it to
both and the checkers will report `FIXED BUILD` (exit 3) for it.

```
# Inventory CSV you build yourself. Header: host,version,internet_exposed   (yes, no or offline; # lines skipped)
bash scripts/check-ncentral.sh --csv inventory.csv [--log access.log ...] [--audit audit-export.csv ...]
bash scripts/check-ncentral.sh --host nc01 --exposed yes --version 2026.4.0.31
pwsh -File scripts/Check-NCentral.ps1 -Csv inventory.csv -Log access1.log,access2.log -Audit audit-export.csv
pwsh -File scripts/Check-NCentral.ps1 -HostName nc01 -Exposed yes -Version 2026.4.0.31
```

| Exit | Verdict | Meaning |
|---|---|---|
| 0 | OFFLINE/NOT EXPOSED | Recorded as offline, or as not internet exposed (still unpatched; N-able advises offline) |
| 1 | EXPOSED / NO PATCH AVAILABLE | Recorded as internet exposed, any version |
| 2 | UNKNOWN | Exposure value not recognised or missing; also `--log` or `--audit` alone with no hits |
| 3 | FIXED BUILD | Reserved. Never returned while the fixed build list is empty |
| 4 | LOG REVIEW | Our log or audit patterns matched (overrides the inventory verdict) |
| 5 | Usage or read error | |

CSV mode exits with the worst row (1 > 2 > 0). `--log` reads a combined format access log and reports any request
under `/applianceLog/`, and any source with 2xx responses from both MMS and UI SOAP services. `--audit` reads any
saved text or CSV export and reports lines mentioning "Default Administrator", credential changes, or accounts created,
added or enabled.

## Testing

`tests/run_all.sh` runs shellcheck, PSScriptAnalyzer, the bash tests, the Pester tests (including bash vs PowerShell
parity), guards (no network, write or exec primitives in scripts, fixtures marked `FIXTURE_ONLY` with RFC 5737 IPs
only, no em or en dashes, fixed build lists empty), both checkers inside a bwrap sandbox with no network and a
read-only filesystem with a sha256 before and after check of the pack, and `sigma check` plus conversions. The
fixtures are synthetic; no fixture contains an exploit request body or payload.

## ATT&CK mapping (MITRE)

T1190 Exploit Public-Facing Application, T1078.001 Valid Accounts: Default Accounts, T1098 Account Manipulation,
T1136.001 Create Account: Local Account, T1068 Exploitation for Privilege Escalation, T1505.003 Web Shell,
T1059.004 Unix Shell, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1072 Software Deployment Tools,
T1219 Remote Access Tools, T1105 Ingress Tool Transfer.

## Sources

Primary:

* N-able Uptime page (incident updates): https://uptime.n-able.com/ (fetched 9 Nov 2026 22:15 and 22:25 UTC)
* N-able status and release notes: https://status.n-able.com/ (fetched 22:14 UTC; no incident post)
* N-able docs, Windows Agent paths: https://documentation.n-able.com/N-central/troubleshooting/Content/kb/How-to-ghost-or-clone-a-PC-with-a-Windows-Agent.htm
* N-able docs, n-able.app overview: https://documentation.n-able.com/N-central/userguide/Content/Ecoverse-views/n-able-app-overview.htm
* NVD API keyword searches (22:15 UTC) and NVD records for earlier N-central flaws:
  https://nvd.nist.gov/vuln/detail/CVE-2025-11700 , https://nvd.nist.gov/vuln/detail/CVE-2025-9316 ,
  https://nvd.nist.gov/vuln/detail/CVE-2026-86218
* CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (JSON feed, catalogue version 2026.11.09)
* MITRE ATT&CK: https://attack.mitre.org/

News (secondary context only):


Research credited to security researchers. We do not link the proof of concept.