N-able took its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that could allow attackers to take over vulnerable systems.
Security researcher Sean Bales revealed vulnerabilities on Sunday November 8 and released a GitHub repository called Capable2Shell containing proof-of-concept exploits for the vulnerabilities.
N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) and IT teams to monitor, manage and secure customer devices and networks remotely.
The researcher says the vulnerabilities were tested on N-central Appliance 2026.4.0.31, an early version of the software, and believes most, if not all, of the flaws affect earlier versions as well.
Bales also confirmed to BleepingComputer that the discovery of the vulnerabilities was assisted by AI.
Disclosed vulnerabilities include authentication bypasses, credentials disclosure, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity (XXE) injection, and remote code execution (RCE) vulnerabilities.
One of the most critical exploit chains exploits an unauthenticated XXE vulnerability in N-central’s Service Import functionality to steal a trusted local session, reset an account’s password, and execute commands on the server as an authorized user.
The same exploit can also create a default administrator account enabled with credentials controlled by the attacker, thereby providing malicious administrative access to the N-central management interface.
Bales shared a video demonstration of this exploit, showing terminal output reporting successful creation of an administrator account, login authentication, access to protected administrative features, and execution of remote commands like able user.
Other leaked exploits include stored XSS that can execute commands as root when an administrator views malicious patch metadata, and an elevation of privilege flaw that allows code to run as root. nable account to run commands as root.
Bales confirmed to BleepingComputer that the unauthenticated XXE to RCE exploit was the most critical of the disclosed vulnerabilities.
N-able Takes Servers Offline Worldwide
After disclosure, N-able announced a critical security incident and took its N-central environments hosted in the Americas, Europe, and Asia Pacific regions offline.
Although BleepingComputer has not independently verified all of the reported vulnerabilities, N-able has confirmed that it is developing a patch to address the security issues, lending credence to the researcher’s claims that at least some of the flaws are legitimate.
“N-able is actively responding to an unrelated communication of critical vulnerabilities in N-central on Sunday evening, November 8, discovered by an independent researcher,” N-able told BleepingComputer.
“As a precautionary measure, we took our N-central hosted environment offline today, November 9, and have provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice. »
“Our security, engineering, and operations teams are actively working to implement the necessary corrective measures. At this time, we have not observed any active exploitation of these vulnerabilities. Protecting our customers and their environments remains our top priority, and we will provide additional updates as they become available.”
In a sequel status updateN-able said it was continuing to develop and validate a patch and found no evidence of active exploitation or unauthorized access to data.
Although the classic N-central environment is not available, N-able said that Ecoverse services accessible via N-able Login remain operational.
N-able did not provide an estimate for when N-central will come back online, but says it plans to post updates every four hours, or sooner if new information becomes available.
Researcher says previous vulnerability reports were ignored
Bales told BleepingComputer that he deliberately released the N-central vulnerabilities without notifying N-able first, because the company allegedly failed to fix the vulnerabilities he had previously reported in another N-able product.
According to Bales, it disclosed two remote code execution vulnerabilities unrelated to an elevation of privilege flaw about five to six months ago, but those vulnerabilities have still not been patched.
“I disclosed 2 unrelated RCEs for another N-able product, as well as a priv esc vulnerability 5-6 months ago. Those haven’t been patched yet. I haven’t disclosed any of the 0-days I released last night,” Bales told BleepingComputer.
He also claims to have sent follow-up emails over the past four to six weeks with no response.
Bales claims that his previous experience with N-able’s vulnerability disclosure process and the fact that “they don’t take disclosure seriously” led him to publish N-central’s zero-day exploits.
However, he said these exploits target a different N-able product than those he previously disclosed.
The researcher also claimed that he did not receive any payment through N-able’s bug bounty platform for his previous reports.
Bales confirmed that N-able executives, including the company’s CEO and CTO, contacted him following the disclosure and asked him to remove the GitHub repository and work with the company.
“They didn’t threaten me or anything. They only asked me to delete the repo, work with them, etc.”
BleepingComputer asked N-able about Bales’ allegations regarding previously disclosed vulnerabilities, their patch status, and the alleged lack of responses to his follow-up emails.
However, the company did not respond to these questions, only providing a statement regarding the N center security incident and the precautionary closure.
Previously reported vulnerabilities are not included in the publicly released Able2Shell repository and would not be fixed.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s happening with a 14-day read-only scan of Microsoft 365 or Google Workspace, without MX modifications.
