N-able pulls N-central offline after November 8 zero-day dump

N-able pulled its hosted N-central environments offline across the Americas, Europe and Asia-Pacific, and told on-premises customers to power down their own servers, after a researcher published more than 30 alleged zero-day vulnerabilities with working proof-of-concept exploits and no advance notice.

Sean Bales released the flaws late Sunday, November 8, in a GitHub repository called Able2Shell. N-central is a remote monitoring and management platform, the software a managed service provider uses to reach into every customer device it manages.

The exploits were tested against N-central Appliance 2026.4.0.31, a pre-release build, and Bales believes most or all of them reach back into earlier versions. The set covers authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity injection and remote code execution. Bales confirmed the discovery was AI-assisted.

The chain he rates most critical begins with an unauthenticated XXE flaw in N-central’s service-import functionality. From there the exploit steals a trusted local session, resets an account password and runs commands as the nable user. The same path can create an enabled Default Administrator account with attacker-chosen credentials, handing over the management interface outright. Bales published a video showing the account creation, a successful login, access to protected admin functions and command execution as nable.

Two other exploits are worth calling out. A stored XSS executes commands as root when an administrator views malicious patch metadata. A separate privilege-escalation flaw lets code already running as the nable account escalate to root. Put the unauthenticated XXE entry point together with the priv-esc and you have a path from no credentials to root on an appliance that manages fleets of other machines.

N-able declared a critical security incident and took its hosted N-central environments offline worldwide on November 9. It confirmed it is developing a hotfix, which lends weight to the claim that at least some of these are real. The company said it had not observed active exploitation and, in a later update, found no evidence of active exploitation or unauthorized data access. The N-central classic environment is down; Ecoverse services reached through N-able Login stay up. N-able said it would post updates every four hours.

As of November 11 that hotfix is out, and N-able says it has already seen attempts to scan for these vulnerabilities. Scanning is not exploitation, but it closes the window. If you run N-central on-premises, N-able’s guidance was to take the server offline until further notice, and the hotfix is now available to apply.

The disclosure itself is the other half of this. Bales says he dropped the zero-days without warning because N-able ignored earlier work. He reported two unrelated RCEs and a privilege-escalation flaw in a different N-able product roughly five or six months ago, says they remain unpatched, and says follow-up emails over the past four to six weeks went unanswered. He also says he was never paid through N-able’s bug bounty platform for those reports. His stated reason for going public: “they don’t take disclosure seriously.”

After the Able2Shell repo went up, N-able’s CEO and CTO contacted Bales and asked him to take it down and work with them. By his account there were no threats, only the request. BleepingComputer asked N-able about the earlier reports, their patch status and the unanswered emails; the company answered none of it, offering only its statement about the N-central incident and the shutdown.

Those earlier vulnerabilities are not in the Able2Shell repo and, by Bales’s account, are still unpatched. That leaves at least two RCEs and a privilege-escalation flaw in another N-able product he kept out of the public repo and, if he is right, unfixed.