N-able N-central Down: Hosted Servers Patched After Zero-Day Leak

N-able’s hosted N-central environments were taken offline on Nov. 9 across the Americas, Europe and Asia-Pacific, the company told BleepingComputer. N-central is the remote monitoring and management platform that IT departments and managed service providers use to run client networks and devices. In a Tuesday update, N-able said every hosted N-central server in all regions has now been upgraded.

On-premises customers, who run N-central on their own servers, were asked to disconnect those servers until further notice. N-able now strongly recommends that they install the new release, N-central 2026.4 HF2, as soon as possible.

What N-able says happened

N-able told BleepingComputer on Monday that it learned late Sunday, Nov. 8, of critical N-central vulnerabilities that an independent researcher had published without first informing the company. It described the shutdown of the hosted service as a precaution. The company has not said how long individual customers were without access.

Once the hotfix was ready, N-able told customers to follow its published upgrade instructions carefully before restoring normal access to their N-central environment. It added that earlier guidance had told on-premises customers to keep servers offline while a fix was being built.

The hotfix covers several of the leaked flaws, including those N-able treats as the most severe. They include XML external entity bugs, OGNL injection bugs, a privilege escalation to root, stored cross-site scripting, server-side request forgery and remote code execution through a file upload path. Seven vulnerability identifiers are listed in the release.

Researcher says earlier reports went unanswered

Security researcher Sean Bales published the flaws late Sunday, along with a GitHub repository named Able2Shell that holds proof-of-concept exploit code. He said they affect N-central Appliance 2026.4.0.31, a pre-release build, and he believes most or all of them also exist in earlier versions.

The disclosed problems range from remote code execution and authentication bypass to credential disclosure, arbitrary file writes, directory traversal and cross-site scripting. Bales also demonstrated an exploit chain that needs no login. It abuses the service-import feature to take over a trusted local session, reset an account password and run commands on the server. An attacker could also use it to create a Default Administrator account with credentials the attacker controls, giving access to the management interface.

Bales told BleepingComputer he skipped notifying N-able because the company had not fixed bugs he reported in a different N-able product about five to six months earlier. Those included two unrelated remote code execution bugs and a privilege escalation flaw. N-able did not respond to questions about that claim and sent a statement about the N-central incident and the precautionary shutdown instead.

Exposure and scanning

N-able has not said that the flaws are being exploited in real attacks. Threat intelligence company Defused said on Tuesday that it had seen probing of N-central for the leaked zero-days over the previous 24 hours. According to Defused, this included opening anonymous agent sessions, pulling appliance configuration and reaching the remote control endpoint without authentication. Defused urged administrators to take N-central servers offline right away.

Internet security nonprofit Shadowserver reports that just over 148 N-central servers are currently reachable from the internet, down from 1,338 it counted on Monday.

Why it matters

N-central sits in the middle of how IT providers manage their customers’ machines. N-able provides tools for managed service providers and enterprise IT departments at more than 500,000 organizations in over 140 countries. When the hosted platform goes dark, the providers that rely on it lose their central console for monitoring and maintaining client devices until access is restored.

The company has not disclosed how many customers were affected by the shutdown. Hosted customers now run on upgraded servers. On-premises customers remain responsible for installing the patch themselves, and N-able has told them to follow its upgrade guidance before bringing servers back online.

Source: BleepingComputer