N-able has taken its hosted N-central environments offline and told customers who run N-central on their own servers to switch them off, after a security researcher published more than 30 alleged zero-day vulnerabilities in the product along with proof-of-concept exploits. N-central is a remote monitoring and management (RMM) platform that managed service providers and IT teams use to administer their customers’ computers and networks, so a server takeover there can reach every device it manages. N-able has run into this before: we covered attacks on on-premises N-central servers in August and a maximum-severity RCE hotfix in September, but this is a new disclosure.
According to BleepingComputer, the researcher, Sean Bales, published the flaws late on Sunday, November 8, without telling N-able first, and said AI helped find them. They include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity (XXE) injection and remote code execution. Bales told BleepingComputer the most critical is an unauthenticated XXE flaw in the service-import feature that can be chained to steal a trusted session, reset an account password, run commands as the nable user and create a new Default Administrator account. He says he tested against a pre-release build, N-central Appliance 2026.4.0.31, and believes most or all of the flaws also affect earlier versions. BleepingComputer has not independently verified every flaw, but N-able confirmed it is building a hotfix. The company said it has not seen active exploitation or unauthorized data access, and will post updates about every four hours. Bales said he released the flaws without notice because earlier reports about a different N-able product went unpatched; N-able did not answer BleepingComputer’s questions about that.
How to check if you’re affected
Affected products are N-able’s N-central platform. Hosted N-central environments in the Americas, Europe and Asia-Pacific are offline, so hosted customers cannot use the classic N-central console until N-able restores it; N-able says its Ecoverse services reached through N-able Login are still running. Affected versions are not fully established: the researcher tested the 2026.4.0.31 pre-release appliance and believes earlier versions are also affected, and N-able has not published a fixed version or an estimate for when service returns.
If you run N-central on your own server, N-able’s guidance, as relayed by BleepingComputer, is to temporarily take that server offline until further notice. N-able posts status updates on its status dashboard (uptime.n-able.com); that page did not render for us, so we have not read its contents directly. Use N-able’s own communications, not this post, to decide when it is safe to bring a server back.
Sources
- BleepingComputer: N-able takes cloud platform offline after 30+ “zero-days” published
- N-able status dashboard (the page loaded as an empty shell; N-able’s statements are as quoted by BleepingComputer)
- The researcher’s exploit repository is linked from the BleepingComputer article; we have not linked it here.