N-able took its hosted N-central platform offline on Monday 9 November 2026 and told customers who run N-central on their own servers to switch them off until further notice. Late on Sunday 8 November, an independent security researcher had published details and working exploit code for what they describe as 33 vulnerabilities in N-central, under the name "Able2Shell". N-central is a remote monitoring and management (RMM) platform that IT service providers use to look after their customers' computers, which for many small manufacturers includes the CAD workstations, PDM servers and licence servers that SOLIDWORKS runs on.
Most SOLIDWORKS users have never heard of N-central, and that is exactly the point. If your company outsources IT to a managed service provider (MSP), there is a good chance a small agent program from an RMM tool runs on every PC in the design office. It lets the provider install updates, run scripts, open remote sessions and deploy software without walking over to the machine. N-able's own marketing says its platform serves more than 500,000 organisations, and N-central is one of its main products.
That kind of access is useful for your IT provider and very valuable to an attacker. Here is what happened, what is confirmed and what is not, and what SOLIDWORKS teams should ask their IT provider this week.
TL;DR: if an MSP manages your CAD PCs, ask today whether they use N-central and what they have done since 9 November
A researcher published exploit code for 33 alleged N-central flaws on 8 November 2026. According to the researcher and to Huntress, the flaws can be chained into remote code execution, new administrator accounts and root access on the N-central server. N-able took hosted N-central offline on 9 November, told on-premises customers to shut their servers down, and said it had not observed active exploitation. A hotfix was expected around midday US Eastern time on 10 November; no CVE numbers or affected version list had been published at the time of writing. For SOLIDWORKS teams the risk is indirect but serious: whoever controls the RMM server can run commands on every managed CAD workstation and server, including the PDM vault and its backups.
What happened to N-able N-central?
On the evening of Sunday 8 November 2026, a researcher posted a GitHub repository called Able2Shell with write-ups, screenshots and proof-of-concept code. The researcher said they had tested the exploits on a pre-release build, N-central Appliance 2026.4.0.31, and that earlier versions are probably affected too. They also said the work was assisted by AI, and that they went public without warning N-able because flaws they had reported earlier in a different N-able product were still unpatched. N-able has not answered that last claim in public.
The reported flaws cover a wide range of classic web application problems:
- Authentication bypass and credential disclosure, which can expose the passwords and tokens the server uses.
- An unauthenticated XML external entity (XXE) flaw in a service-import feature, which the researcher says can be chained to take over a session, reset a password, run commands and create a new administrator account.
- Arbitrary file writes and directory traversal, which let an attacker place or read files where they should not.
- Stored cross-site scripting that, according to the researcher, can run commands as root when an administrator views malicious patch information.
- Privilege escalation from the N-central service account to root on the appliance.
According to Huntress, the 33 flaws combine into four exploit chains: three lead to remote code execution and one to privilege escalation to root. Censys counted 1,728 N-central hosts visible on the internet. Neither Censys nor the press has independently validated every claimed impact, and N-able has not confirmed the count of 33.
On Monday 9 November at 15:15 UTC, N-able opened a security incident on its status page, describing a "non-responsible communication of critical vulnerabilities in N-central". It took its hosted N-central environments offline as a precaution and advised on-premises customers to take their own N-central servers offline until it tells them otherwise. A company spokesperson told TechTarget: "At this time, we have not observed active exploitation of these vulnerabilities."
On 10 November N-able said its hotfix work was on track and expected the fix around midday US Eastern time that day. Until it ships, there are no CVE identifiers, severity scores or official list of affected versions. Huntress notes that a live hotfix may not change the version number, so the patched server could still show 2026.4.0.31.
Why does an RMM flaw matter to SOLIDWORKS teams?
An RMM agent usually runs with the highest rights on the machine it manages. That is how it can install Windows updates, push a new SOLIDWORKS service pack or restart a stuck PDM service at night. From the RMM console, an administrator can open a remote desktop on any managed PC, run a script on hundreds of machines at once and deploy software silently. If an attacker becomes an administrator on the RMM server, they get the same powers.
This is not a theoretical worry. In July 2021, the REvil ransomware gang used a flaw in Kaseya VSA, another RMM product, to push ransomware through IT service providers to their customers in one move. Huntress points out that earlier attacks on N-central itself led attackers to push unauthorised scripts and tools to downstream environments, and BankInfoSecurity reports that this would be N-able's fifth emergency hotfix since 1 August 2026.
For a design office, the machines in reach are the ones that hold the crown jewels. As our report on ransomware groups listing CAD drawings as loot shows, attackers now steal design data before they encrypt it, because drawings and models put extra pressure on the victim. An RMM foothold gives them a quiet way to reach:
- CAD workstations, with local copies of parts, assemblies and drawings, cached PDM files and the engineer's saved logins.
- The SOLIDWORKS PDM archive and database servers, which hold every version of every file in the vault. Our PDM security configuration guide explains how vault permissions work, but a script running as a local administrator on the archive server can bypass them.
- The SolidNetWork licence server, which is small, often forgotten and always on.
- File servers, NAS devices and backup jobs, which attackers try to delete or encrypt first, as in the recent ransomware campaign against unpatched Synology NAS devices.
The danger is also in the timing. While N-central is offline, your provider cannot use it to patch, monitor or remote into your PCs. Microsoft's monthly security updates are due on Tuesday 10 November, the second Tuesday of the month, so updates that normally arrive automatically may be delayed.
Which SOLIDWORKS systems should you check, and what should you look for?
Use this table when you talk to your IT provider. It lists the systems an RMM tool typically manages in a SOLIDWORKS environment and the signs worth checking for the period since 8 November:
Make sure you can always prove which designs are yours.
BORIS for SOLIDWORKS registers your CAD files with a blockchain timestamp and a certificate of ownership from inside SOLIDWORKS. If attackers copy or leak your models, you can still show what your team created and when.
👉 Get BORIS for SOLIDWORKS
What should SOLIDWORKS teams do now?
- Ask your IT provider one direct question today: do you use N-central, hosted or on your own server, to manage our machines? If the answer is no, ask which RMM tool they do use and how they handle its security updates.
- If they use N-central, ask what they did after 9 November. Was their on-premises server taken offline as N-able advised? Will they apply the hotfix before bringing it back, and when will they confirm that in writing?
- Ask for a log review. Huntress recommends reviewing authentication activity from 8 November onwards, and looking for unusual remote sessions, new scripts and new administrator accounts. Ask your provider to share what they found for your site.
- Check your own side. On CAD workstations, the PDM servers and the licence server, look for local administrator accounts nobody recognises, new scheduled tasks and software installed since 8 November. Our guide to endpoint protection for CAD workstations lists what good monitoring should catch.
- Confirm you have an offline backup of the PDM vault. That means both the archive files and the SQL database, from before 8 November, stored where neither the RMM agent nor an administrator account can delete it. Test that you can restore it.
- Do not miss this month's updates. While N-central is offline, make sure Windows and SOLIDWORKS-related updates still reach your machines through another route, and check them again once the RMM is back.
- Rotate passwords if anything looks wrong. If unauthorised activity is found, change N-central administrator, service and integration credentials, plus PDM admin and SQL accounts and any passwords stored on affected machines.
- Put RMM security in your contract. Ask for multi-factor authentication on the provider's console, a named contact for incidents, notice within a set number of hours, and a list of which tools have admin rights in your network.
What is the bigger lesson about outsourced IT and CAD data?
Small manufacturers rarely have their own security team, so outsourcing IT is often the sensible choice. But it means a third party holds keys to every machine in the design office, and a flaw in their tools becomes your problem without warning. The same pattern appears in our recent reports on the SonicWall VPN flaw that skips MFA and the Ivanti VPN zero-days: the tools that give trusted people remote access are the first thing attackers look for.
Three habits help. Keep a written list of every tool that has administrator rights in your network, including your provider's. Give each tool only the access it needs, using role-based access for CAD environments so a single compromised account cannot read everything. And track who opens CAD files, so unusual bulk access stands out. Our articles on integrating third-party security tools with SOLIDWORKS and protecting SOLIDWORKS files in remote work cover the practical side.
This week also showed the same lesson for software on the desktop: our report on the MecAgent AI add-in and its CAD file collection terms looked at what happens when a tool with full file access is installed without anyone checking its terms.
How does this fit the bigger picture for CAD users?
Across our network, this week's news shows how attackers reach engineering data through shared and trusted systems:
- Shared project servers. CADChain reports on the cyberattack on the Brenner Base Tunnel company, where attackers reached a server used to exchange data with Italian contractors and a ransom was demanded.
- Industrial gateways. BORIS Inventor explains how Node-RED instances without a login were attacked, including on Siemens IoT gateways, and what machine builders should check.
- Platform rules. Blended BORIS covers itch.io's clean-up of AI-generated uploads and its new disclosure rules, a reminder that where your files live decides who sets the rules.
Conclusion
N-able reacted quickly by pulling hosted N-central offline and telling on-premises customers to do the same, and it says it has seen no active exploitation. But public exploit code for an RMM platform starts a race: a researcher quoted by TechTarget, whose honeypots had seen no attempts on Monday, expected that to change quickly, and every unpatched server that comes back online is a door into many customer networks at once.
For SOLIDWORKS teams, the job this week is simple and mostly made of questions. Find out whether your provider uses N-central, make sure it stays offline until it is patched, ask for a log review, and check that your PDM vault has a clean offline backup. Then keep dated proof of your designs, so that whatever happens to your network, you can still show what your team created.
Keep independent proof of your SOLIDWORKS designs, whoever manages your IT.
BORIS for SOLIDWORKS adds blockchain timestamps and certificates of ownership to your CAD files from inside SOLIDWORKS, so you can show what your team designed and when.
👉 Get BORIS for SOLIDWORKS
FAQ: N-able N-central, Able2Shell and SOLIDWORKS
What is N-able N-central?
N-central is a remote monitoring and management (RMM) platform from N-able, a company based in Burlington, Massachusetts. IT service providers and internal IT teams use it to monitor, update and remotely control the computers and servers they manage. It runs as a hosted service or on the customer's own server.
What is Able2Shell?
Able2Shell is the name a researcher gave to a set of 33 alleged N-central vulnerabilities and exploits published on GitHub on 8 November 2026. According to the researcher and Huntress, they chain into remote code execution, new administrator accounts and root access on the N-central server.
Has anyone been hacked through these flaws?
N-able said it had not observed active exploitation when it took N-central offline on 9 November 2026, and we found no confirmed attack at the time of writing. Because exploit code is public, that can change quickly.
Is SOLIDWORKS itself vulnerable?
No. The flaws are in N-central, not in SOLIDWORKS, PDM or other Dassault Systemes software. SOLIDWORKS machines are only at risk if they are managed by an N-central server that an attacker takes over.
How do I know whether my IT provider uses N-central?
Ask them directly. You can also look for N-able or N-central agent software in the installed programs or services list on a managed PC, but the provider can confirm which version and setup they use.
Is there a patch?
N-able said on 10 November 2026 that a hotfix was expected around midday US Eastern time that day. Follow N-able's status page and ask your provider to confirm in writing when their server is patched and back online.
How does BORIS for SOLIDWORKS help?
It does not patch servers or detect attacks. It gives your SOLIDWORKS files blockchain-timestamped certificates of ownership, so if designs are stolen or leaked you can still prove what your team created and when.