N-able took its N-central hosted environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that could allow attackers to take control of vulnerable systems.
Security researcher Sean Bales disclosed the vulnerabilities on Sunday evening, November 8, and published a GitHub repository called Able2Shell that contains proof-of-concept exploits for these flaws.
N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) and IT teams to remotely monitor, manage, and secure customer devices and networks.
The researcher says the vulnerabilities were tested against N-central Appliance 2026.4.0.31, a pre-release version of the software, and believes that most, if not all, of the flaws also affect earlier versions.
Bales also confirmed to BleepingComputer that the discovery of the vulnerabilities was assisted by artificial intelligence.
The disclosed vulnerabilities include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity injection (XXE), and remote code execution (RCE) flaws.
One of the most critical exploit chains abuses an unauthenticated XXE vulnerability in N-central's service import functionality to steal a trusted local session, reset an account's password, and execute commands on the server as the nabil user.
The same vulnerability can also create an enabled Default Administrator account with credentials controlled by the attacker, providing rogue administrative access to the N-central administration interface.
Bales shared a video demonstration of this vulnerability, showing terminal output reporting the successful creation of an administrator account, authentication, access to protected administrative functionality, and remote command execution as the nable user.
Other disclosed vulnerabilities include a stored XSS that can execute commands as root when an administrator views the metadata of malicious patches, and a privilege escalation bug that allows code running under that account to execute commands as root.
Bales confirmed to BleepingComputer that the unauthenticated XXE-to-RCE vulnerability was the most critical of the disclosed vulnerabilities.
N-able takes servers offline worldwide
Following the disclosure, N-able announced a critical security incident and took offline its N-central hosted environments in the Americas, Europe, and Asia-Pacific regions.
Although BleepingComputer has not independently verified all of the reported vulnerabilities, N-able has confirmed that it is developing a hotfix to address the security issues, lending credence to the researcher's claims that at least some of the vulnerabilities are legitimate zero-day vulnerabilities.
"N-able is actively responding to the irresponsible communication of critical vulnerabilities in N-central, discovered late Sunday night, November 8, by an independent researcher," N-able told BleepingComputer.
"As a precautionary measure, we took our hosted N-central environment offline today, November 9th, and provided guidance to customers operating on-premises N-central servers to temporarily take them offline until further notice."
"Our Security, Engineering, and Operations teams are actively working to implement the necessary remediation. At this time, we have not observed active exploitation of these vulnerabilities. Protecting our customers and their environments remains our top priority, and we will provide additional updates as they become available."
In a subsequent status update , N-able stated that it was continuing to develop and validate a hotfix and that it had found no evidence of active exploitation or unauthorized access to data.
Although the classic N-central environment is not available, N-able stated that Ecoverse services accessed through N-able Login remain operational.
N-able did not provide an estimate of when N-central will be back online, but says it plans to publish updates every four hours or sooner if new information becomes available.
A researcher claims that previous reports of vulnerabilities were ignored
Bales told BleepingComputer that he deliberately released the N-central vulnerabilities without first notifying N-able because the company allegedly failed to patch vulnerabilities it had previously reported in another N-able product.
According to Bales, he disclosed two unrelated remote code execution vulnerabilities and a privilege escalation bug about five to six months ago, but these vulnerabilities remain unpatched.
"We disclosed 2 unrelated RCEs for another N-able product, along with a private vulnerability 5 or 6 months ago. They haven't been patched yet. We didn't disclose any of the 0-days that we posted last night," Bales told BleepingComputer.
He also claims to have sent follow-up emails over the past four to six weeks without receiving a response.
Bales says his previous experience with N-able's vulnerability disclosure process and that "I don't take disclosure seriously" led him to publish the zero-day exploits from N-central.
However, he said that these exploits target a different N-able product than those previously disclosed.
The researcher also claimed that he did not receive any payment through N-able's bug bounty platform for his previous reports.
Bales confirmed that N-able executives, including the company's CEO and CTO, contacted him following the revelation and asked him to remove the GitHub repository and collaborate with the company.
"However, they didn't threaten me or anything like that. They just asked me to delete the repository, collaborate with them, etc."
BleepingComputer asked N-able about Bales' allegations regarding previously disclosed vulnerabilities, the status of patching, and the alleged lack of responses to his follow-up emails.
However, the company did not answer these questions, providing only the statement regarding the security incident at N-central and the preventive closure.
Previously reported vulnerabilities are not included in the publicly released Able2Shell repository and are assumed to remain unpatched.