N-able takes N-central offline after disclosure of more than 30 alleged zero-days
N-able took its hosted N-central environments offline across the Americas, Europe and Asia-Pacific on November 9 after researcher Sean Bales publicly disclosed more than 30 alleged zero-day vulnerabilities. N-able also told customers running on-premises N-central servers to take them offline until further notice, according to BleepingComputer.
N-central is a remote monitoring and management platform that managed service providers and IT teams use to monitor and manage customer devices and networks, BleepingComputer wrote. The researcher published proof-of-concept exploits in a GitHub repository called Able2Shell late on November 8.
The disclosed issues include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity injection and remote code execution, according to the report. Bales tested them against N-central Appliance 2026.4.0.31, a pre-release version, and said he believed most or all of the flaws also affected earlier versions.
The most serious reported chain starts with an unauthenticated XML external entity flaw in N-central's service-import function. According to BleepingComputer, the chain can steal a trusted local session, reset an account password and execute commands as the nable user. It can also create an enabled Default Administrator account with attacker-controlled credentials.
Another reported flaw is stored cross-site scripting that can execute commands as root when an administrator views malicious patch metadata. A separate privilege-escalation issue can allow code running as the nable account to execute commands as root, the report said.
N-able said it is developing and validating a hotfix. The company told BleepingComputer that it had not observed active exploitation, and a later status update said it had found no evidence of active exploitation or unauthorized data access. BleepingComputer said it had not independently verified all of the reported vulnerabilities.
N-able has not given a date for restoring N-central. While the classic N-central environment is unavailable, N-able said Ecoverse services accessed through N-able Login remain operational. The company plans to publish updates every four hours or sooner if new information becomes available, according to BleepingComputer.