N-able N-central: Local privilege escalation via insecure IPC channels

Summary

N-able N-central, a remote monitoring and management platform used by MSPs, is affected by a missing authentication vulnerability (CWE-306) in an inter-process communication channel. A local user with low privileges on the N-central server can escalate their privileges. The attacker needs an existing foothold on the server, so the flaw is not directly reachable from the internet. The CVE is part of the wider Able2Shell disclosure, which includes further N-central flaws that are more severe.

Affected

• N-central before 2026.4.1 (CNA record: affected versions 0 to < 2026.4.1)
• Default configuration: unaffected according to the CNA record
• Whether 2026.4.0.31 is the exact last vulnerable build: Unknown.

Fixed in

• N-central 2026.4 Hotfix 2 (HF2), build 2026.4.1.26 or later

Workaround

• No vendor workaround for this CVE is documented.
• Interim guidance from N-able for on-premises customers was to shut down affected servers until the fix was released.
• Until HF2 is installed: restrict access to the server and limit local accounts.

Exploitation

• Exploitation in the wild for this CVE: not confirmed. N-able reports no active exploitation as of 9 Nov 2026.
• Not listed in CISA KEV at the time of research.
• Public PoC code for 33 alleged N-central flaws (Able2Shell) was published on GitHub on 9 Nov 2026. Whether a PoC maps to this CVE is unconfirmed.
• Attempts against N-central honeypots were reported after the Able2Shell disclosure; this is not specific to this CVE.

Our recommendation

• If N-central is in use, confirm that the build is at least 2026.4.1 (HF2) and install HF2 as soon as possible.
• Treat the update as urgent because of the wider Able2Shell disclosure, not because of this CVE alone.
• Restrict local access to the N-central server and review local accounts.
• Hunt for suspicious agent-launched shells and newly created local accounts.
• If you are an SME customer of an MSP, ask your MSP whether its N-central server is patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• N-able security advisory CVE-2026-91000 me.n-able.com
• N-central 2026.4 HF2 release notes status.n-able.com
• Huntress: N-able disables cloud services after Able2Shell www.huntress.com
• CSO Online: N-central emergency fix www.csoonline.com
• CVE-2026-91000 record summary (ThreatInt) cve.threatint.com
• AHA H-ISC threat bulletin on N-central www.aha.org
• CSA research note on Able2Shell labs.cloudsecurityalliance.org
• SecurityOnline: N-central PoC exploits securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:13.