N-able takes hosted N-central offline after Able2Shell disclosure
Original title: N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
Sean Bales published PoCs for more than 30 flaws; N-able says it has seen no active exploitation.
N-able took hosted N-central offline and told on-premises customers to shut down servers after researcher Sean Bales published proof-of-concept exploits for more than 30 flaws collectively called Able2Shell. Issues tested on N-central Appliance 2026.4.0.31 include credential disclosure, arbitrary file writes, directory traversal, XSS, XXE, and remote code execution. N-able said it has not seen active exploitation and is preparing a hotfix. Ecoverse services under N-able Login remain online.
Unconfirmed: N-able says it has not observed exploitation; the report is a developing story.
- Hosted N-central in the Americas, APAC, and Europe is offline.
- On-premises customers in those regions were urged to shut servers down.
- Reported chains can steal credentials, create administrators, and execute code as root.
- A GenericTCP stack overflow can achieve root command execution.
- Ecoverse services under N-able Login, including patching, remain available.
Impact: rogue administrative access and root command execution
| Product | Affected |
|---|---|
| N-able N-central | 2026.4.0.31 (tested) |
- 1.Shut down on-premises N-central servers until N-able gives further notice.
- 2.Wait for the hotfix N-able says it is preparing.
From the original article
1 min read at thehackernews.com
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell. "As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.