N-able Takes Hosted N-central Offline After 30+ Flaws Posted

N-able’s hosted N-central environments went offline on Nov. 9 across the Americas, Europe and Asia-Pacific, after a security researcher published more than 30 alleged zero-day vulnerabilities, BleepingComputer reported. N-able also told customers who run N-central on their own servers to take those servers offline until further notice. The company has not said when service will return.

N-central is a remote monitoring and management (RMM) platform. Managed service providers and IT teams use it to monitor and manage customers’ devices and networks from a distance.

What N-able has said

N-able called the situation a critical security incident. In a statement to BleepingComputer, the company said it was responding to “non-responsible communication of critical vulnerabilities” received late Sunday night, Nov. 8, from an independent researcher. It described the shutdown of its hosted environment as a precaution.

The company said its security, engineering and operations teams are working on remediation and that it has not observed active exploitation of the vulnerabilities. A later status update said N-able was still developing and validating a hotfix, and had found no evidence of active exploitation or unauthorized data access.

The N-central classic environment is unavailable. N-able said Ecoverse services reached through N-able Login are still working. It plans to post updates every four hours, or sooner if there is new information. No cause beyond the disclosure has been given for the shutdown, and no restoration estimate exists.

What the researcher published

Researcher Sean Bales disclosed the flaws late on Nov. 8 and posted a GitHub repository called Able2Shell with proof-of-concept exploits. He told BleepingComputer that finding the flaws was AI-assisted. He tested them against N-central Appliance 2026.4.0.31, a pre-release version, and believes most or all also affect earlier versions.

The list includes authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity (XXE) injection and remote code execution (RCE) flaws. BleepingComputer said it has not independently verified all of them, but noted that N-able’s work on a hotfix lends weight to the claim that at least some are genuine zero-days, meaning flaws unknown to the vendor before disclosure.

Bales called the most serious one an unauthenticated XXE-to-RCE chain. It abuses N-central’s service-import function to steal a trusted local session, reset an account password and run commands on the server as the nable user. The same exploit can create an enabled Default Administrator account with credentials the attacker chooses. Other exploits let an administrator’s view of malicious patch metadata trigger commands as root, or let code running under the nable account escalate to root.

A dispute over earlier reports

Bales said he released the flaws without warning N-able because the company had not fixed vulnerabilities he reported earlier in a different N-able product. According to him, he reported two unrelated RCE flaws and a privilege-escalation flaw five or six months ago, and they remain unpatched. He said he, his manager and his director sent about five follow-up emails over four to six weeks without a reply, and that he received no bug bounty payment.

He said N-able executives, including the CEO and CTO, contacted him after the disclosure and asked him to take down the repository and work with the company. “They did not threaten me or anything though,” he said. The earlier flaws are not in the public repository.

BleepingComputer put questions about those claims to N-able. The company did not address them and supplied only its statement on the N-central incident.

Why it matters

MSPs use N-central to manage their own customers’ endpoints, so the hosted shutdown removes that management tool for providers who rely on it. Customers with on-premises servers have been asked to take them offline too. N-able’s guidance for now is to wait for its status updates, which it plans to issue every four hours.

Source: BleepingComputer