A security researcher dropped 33 zero-day vulnerabilities with working proof-of-concept exploits against one of the most widely deployed MSP management platforms, and the vendor’s response was to take the entire cloud service offline. That is the lead story today. Alongside it, SAP patches four perfect-10 wormable RCE flaws, CISA confirms active exploitation of Cisco BroadWorks, and Turla shows that government Exchange servers remain the highest-value espionage target on the internet.

In the News

N-able Shuts Down N-central Cloud After 33 Zero-Days Drop

A security researcher published 33 zero-day vulnerabilities - collectively named Able2Shell - targeting N-able’s N-central RMM platform, complete with working proof-of-concept exploits. N-able responded by taking its hosted N-central cloud service completely offline and advising all on-premises customers to shut down their instances immediately.

The blast radius is significant. N-central is a core remote monitoring and management platform used by thousands of managed service providers worldwide. MSPs relying on N-central for endpoint management, patch deployment, and remote access are currently flying blind - they cannot manage customer endpoints through the platform. The PoC exploits being public means the window between disclosure and weaponization by threat actors is effectively zero.

This incident highlights a structural risk in the MSP ecosystem: the management plane itself is a high-value target. Threat actors who compromise an RMM platform gain the same access the MSP has - which is typically administrative access across every customer environment. The 2021 Kaseya VSA incident demonstrated this at scale, and Able2Shell represents the same category of risk against a different platform.

What defenders should do: If your organization uses an MSP, confirm which RMM platform they operate. If it is N-central, understand that your MSP’s management capability is currently offline. Ensure endpoint detection and response agents operate independently of the RMM platform and that you have out-of-band communication channels with your MSP. For MSPs running on-premises N-central: shut down immediately per N-able’s guidance and monitor for indicators of prior compromise.

SAP Patches Four CVSS 10.0 Wormable RCE Flaws

SAP’s November Security Patch Day addresses four maximum-severity vulnerabilities - dubbed ICM2SHELL and PROXYGATE - in NetWeaver Internet Communication Manager (ICM) and Web Dispatcher. All four carry a CVSS score of 10.0 and enable unauthenticated remote code execution.

The flaws are wormable. No user interaction, no valid credentials, and network-adjacent propagation is possible. In most enterprise SAP deployments, Web Dispatcher and ICM are internet-facing by design - they serve as the reverse proxy and HTTP handler for SAP applications. An attacker with network access to these components can achieve full system compromise.

SAP ERP systems are the operational backbone for thousands of large enterprises - payroll, supply chain, financial reporting. Compromise of these systems is not just a security event; it is a business-continuity event.

What defenders should do: Apply SAP November 2026 patches immediately. If patching requires a maintenance window, isolate internet-facing SAP Web Dispatcher and ICM instances behind application-layer firewalls with strict URL and method filtering. Audit which SAP components are directly internet-exposed using your exposure management tooling.

CISA Confirms Cisco BroadWorks Exploitation

CISA added CVE-2026-20320 - an XML external entity (XXE) injection vulnerability in Cisco BroadWorks - to the Known Exploited Vulnerabilities catalog. BroadWorks is a widely deployed unified communications platform that underpins enterprise voice, video, and messaging for thousands of organizations.

The XXE flaw allows attackers to extract configuration data from the BroadWorks platform, potentially exposing credentials, topology information, and service configuration. A companion vulnerability in Openwave Messaging Webtop Media Transcoder (CVE-2026-111793, CVSS 7.5) is being exploited in parallel, indicating that attackers are systematically targeting UC and messaging infrastructure.

Enterprise voice infrastructure has historically received less security scrutiny than web applications or email, but it processes sensitive communications and often sits on flat network segments with limited monitoring.

What defenders should do: Apply Cisco’s patches for BroadWorks immediately. Review SIP and XML traffic inspection rules on your NGFW. Inventory your UC infrastructure attack surface - many organizations do not know which UC components are internet-exposed. Consider network detection and response for east-west visibility into UC traffic segments.

Turla Deploys Cereal Toolset Against Government Exchange Servers

The Russian state-aligned threat actor Turla has deployed a new modular malware toolset called Cereal against on-premises Microsoft Exchange servers in government environments. The toolset installs custom Exchange Transport Agents - legitimate extensibility mechanisms - to intercept email flow and exfiltrate messages to attacker-controlled infrastructure.

The technique is notable because Transport Agents operate within the Exchange pipeline itself, processing every message that flows through the server. Standard Exchange audit logging does not flag the installation of new Transport Agents as a high-severity event, giving the malware persistence and collection capability that is difficult to detect with conventional monitoring. This maps to MITRE ATT&CK technique T1114.002 (Email Collection: Remote Email Collection) and T1505.002 (Server Software Component: Transport Agent).

What defenders should do: Audit installed Exchange Transport Agents across all on-premises Exchange servers. Baseline the expected agents and alert on any additions. Monitor for anomalous outbound data transfers from Exchange servers. Organizations in government verticals should treat this as an active threat and review email security architecture for detection of internal mail interception.

Defender Action Items

  • N-able N-central customers: Confirm RMM platform status with your MSP. Verify EDR operates independently of RMM. Shut down on-premises N-central instances per vendor guidance.
  • SAP administrators: Apply November 2026 patches. Isolate internet-facing ICM and Web Dispatcher instances if patching is delayed. Audit external exposure of SAP components.
  • Cisco BroadWorks operators: Patch CVE-2026-20320 immediately. Enable SIP/XML deep packet inspection on NGFW. Audit UC infrastructure exposure.
  • Exchange administrators: Audit Transport Agent inventory with Get-TransportAgent. Baseline expected agents and create alerts for new installations. Monitor outbound data flows from Exchange servers.
  • Chrome and Outlook: Enforce Chrome auto-update policies for CVE-2026-125350. Apply Microsoft November Patch Tuesday for CVE-2026-124194 Outlook spoofing flaw - disable NTLMv2 relay where feasible.

Detection Queries

The following Splunk SPL query detects new Exchange Transport Agent installations - the persistence mechanism used by Turla’s Cereal toolset. Run against Windows Security and Exchange Management logs.

index=windows sourcetype="WinEventLog:MSExchange Management"
"New-TransportAgent" OR "Install-TransportAgent" OR "Enable-TransportAgent"
| stats count by _time, user, CommandName, ObjectModified
| where count > 0
| sort - _time

This KQL query for Microsoft Sentinel detects the same activity:

ExchangeAdminAuditLog
| where CmdletName in ("New-TransportAgent", "Install-TransportAgent", "Enable-TransportAgent")
| project TimeGenerated, Caller, CmdletName, ModifiedObjectResolvedName, CmdletParameters
| sort by TimeGenerated desc

Both queries will produce false positives during legitimate Exchange maintenance windows. Baseline your environment and correlate with change management tickets.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.