N-able takes N-central offline after 30-plus exploit PoCs published
Original title: N-able takes cloud platform offline after 30+ "zero-days" published
Researcher Sean Bales posted Able2Shell proof-of-concept exploits; N-able says it has seen no active exploitation.
N-able took hosted N-central environments offline on November 9 and told on-premises customers to shut down servers after researcher Sean Bales published more than 30 alleged zero-days, including proof-of-concept exploits. The flaws, tested on N-central Appliance 2026.4.0.31, include authentication bypass, credential disclosure, file writes, XSS, XXE and remote code execution. One unauthenticated XXE chain can steal a local session, reset a password and run commands as the nable user. N-able is developing a hotfix and says it has not observed exploitation or unauthorized data access.
Unconfirmed: N-able has not verified every reported flaw; Bales' claim that earlier reports remain unpatched is unanswered.
- Bales published the Able2Shell GitHub repository late Sunday, November 8.
- Hosted N-central was taken offline in the Americas, Europe and Asia-Pacific.
- A stored XSS can run commands as root when an administrator views malicious patch metadata.
- Ecoverse services accessed through N-able Login remain operational.
- Bales says earlier reports on a different N-able product remain unpatched.
Impact: unauthenticated remote code execution as the nable user
| Product | Affected |
|---|---|
| N-able N-central | tested on Appliance 2026.4.0.31; earlier versions believed affected |
- 1.Take on-premises N-central servers offline until N-able issues further notice.
- 2.Wait for N-able's hotfix before bringing N-central back online.
From the original article
4 min read at bleepingcomputer.com
N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that could let attackers take over vulnerable systems. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.