N-able pulls N-central offline after researcher drops 30+ zero-day exploits

N-able took its hosted N-central environments offline on Monday, November 9, across the Americas, Europe and Asia-Pacific, and advised customers running N-central on their own hardware to shut those servers down too. The trigger: security researcher Sean Bales published more than 30 alleged zero-day vulnerabilities late Sunday, November 8, along with proof-of-concept exploits in a GitHub repository named Able2Shell. N-central is a remote monitoring and management platform that MSPs and IT teams use to watch over customer devices and networks.

The exploit Bales called the most critical abuses an unauthenticated XXE flaw in N-central's service-import feature. According to BleepingComputer, the chain steals a trusted local session, resets an account password and runs commands on the server as the nable user — and can also spin up an enabled Default Administrator account with credentials the attacker chooses. Bales posted a video showing terminal output confirming the admin account creation, a successful login, access to protected admin functions and remote command execution. He confirmed to BleepingComputer it was the worst of the batch.

The broader list covers authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XXE injection and remote code execution. One stored XSS can run commands as root when an administrator opens malicious patch metadata, and a separate privilege-escalation bug lets code running as nable execute as root. Bales tested everything against N-central Appliance 2026.4.0.31, a pre-release build, and believes most or all of the flaws hit earlier versions as well.

N-able called it a critical security incident and confirmed it is building a hotfix, which adds weight to the researcher's claims even though BleepingComputer has not independently verified every flaw. The company described the disclosure as the result of 'non-responsible communication of critical vulnerabilities.' It said it has seen no active exploitation so far, and later added that it found no evidence of unauthorized data access. Ecoverse services reached through N-able Login are still running, but N-able gave no timeline for N-central's return and plans updates every four hours.

Bales skipped the usual heads-up on purpose. He says he reported two unrelated RCEs and a privilege-escalation flaw in a different N-able product roughly five to six months ago, and they still aren't patched. He also claims he, his manager and his director sent about five follow-up emails over four to six weeks with no reply, and that his earlier reports earned nothing through N-able's bug bounty platform. Those older bugs are not part of the Able2Shell repo. N-able didn't answer BleepingComputer's questions about them, offering only its incident statement.

After the dust settled, N-able's CEO and CTO made contact. Bales said executives asked him to take the GitHub repository down and work with the company. 'They did not threaten me or anything though,' he told BleepingComputer. 'Only asked to take down the repo, work with them, etc.'