News
cybersecurity SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities - SecurityWeek threat-intel Critical vulnerabilities in N-able N-central prompt hosted shutdown - Rapid7 Emergent Threat Response cybersecurity Over a Dozen Organizations Hit in Qubole Supply Chain Attack - SecurityWeek threat-intel OffSec Celebrates 20 Years of Practitioner-Built Training From the Creators of Kali Linux and OSCP - GBHackers threat-intel Finite State Raises $27 Million to Help Device Makers Fight ‘Vulnpocalypse’ with AI-Powered Product Security - GBHackers ai The Download: Pelosi’s successor targets AI and data centers face power woes - MIT Technology Review ai Evolving metal extraction processes - MIT Technology Review cybersecurity AI Makes Reverse Engineering Mainstream Software & Malware Far Easier - Dark Reading threat-intel Hackers Abuse Qubole’s Trusted AWS Access to Breach Multiple Cloud Accounts and Steal Sensitive Data - GBHackers cybersecurity Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th) - SANS Internet Storm Center privacy Italian DPA fines Poste Italiane and Deutsche Bank a combined EUR 81 000 for lack of transparency in personal data processing - EDPB - European Data Protection Board cybersecurity Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes - SecurityWeek cybersecurity Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed - The Hacker News cybersecurity SEGA Data Breach Exposes 2.19 Million Email Addresses Following Third-Party Cyberattack - CyberPress cybersecurity SAP patches ICM2SHELL and PROXYGATE maximum severity flaws - BleepingComputer
1 / 15
All news ›
Threat Intel

Critical vulnerabilities in N-able N-central prompt hosted shutdown

Rapid7 Emergent Threat Response ·

Overview On November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central , its remote monitoring and management (RMM) platform. In a public disclosure titled Able2Shell, an independent researcher has published details and proof-of-concept (PoC) code covering 33 issues. According to the disclosure, the issues include unauthenticated remote code execution (RCE), privilege escalation to root, credential disclosure, and unauthorized account creation. One unauthenticated chain combines XML external entity (XXE) and session-handling weaknesses to execute code as the nable service account. Other demonstrated chains involve an administrator viewing malicious patch metadata or use ProductAdmin credentials. Rapid7 Intelligence is currently triaging the newly published details. As of November 10, N-able reported scanning activity associated with the published PoC code and said it had no evidence that any customer environment ha

Continue on Rapid7 Emergent Threat Response ↗ ‹ All news Get the newsletter

The summary and image come from Rapid7 Emergent Threat Response; the image is shown from their website.