30+ Zero-Days Disclosed, N-able Takes N-central Offline

Researcher Sean Bales published proof-of-concept exploits for more than 30 alleged zero-day vulnerabilities in N-able’s N-central platform, a remote monitoring and management tool used by IT teams and managed service providers. The disclosure prompted N-able to take its hosted environments offline worldwide and advise on-premises customers to shut down their servers. The company is developing a hotfix and reports no evidence of active exploitation.

The flaws enable multiple attack vectors including authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity injection, and remote code execution. The most critical is an unauthenticated XXE vulnerability in the service-import function that can be chained to steal sessions, reset passwords, and execute commands as the nable user—or to create rogue administrator accounts with attacker-controlled credentials. Other exploits include a stored XSS vulnerability that executes commands as root when administrators view malicious patch metadata, and a privilege-escalation flaw enabling root command execution. Bales used AI-assisted techniques to discover the vulnerabilities.

Bales disclosed the exploits without prior notification to N-able, citing the company’s failure to address earlier vulnerability reports in a different N-able product from five to six months prior. He claims N-able ignored follow-up emails over subsequent weeks and provided no compensation through its bug bounty program. When N-able executives contacted him after the disclosure requesting removal of the repository and cooperation, he noted they issued no threats, only asked for the repository to be taken down and to work together.