N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
N-able has taken its N-central Hosted Environments offline and urged on-premises customers to shut down servers following the public disclosure of 33 zero-day vulnerabilities with proof-of-concept exploits.
The vulnerabilities, collectively tracked as Able2Shell, were disclosed by independent security researcher Sean Bales, who tested them against N-able N-central Appliance 2026.4.0.31. N-able confirmed it has not observed any signs of active exploitation but is taking precautionary measures.
Critical Vulnerabilities Exposed
The identified zero-day vulnerabilities include credential disclosure, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity (XXE) injection, and remote code execution (RCE) flaws. Chains of vulnerabilities can enable anonymous credential theft, administrator creation, and nable/root RCE.
As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the environment and implement appropriate remediation.
Affected Services
The following services are impacted: N-central hosted versions in Americas, APAC, and Europe regions, as well as N-central On-premise versions across the same regions. During the outage, customers will be unable to access their Hosted N-central classic environment, though Ecoverse services remain available.
Successful exploitation of these flaws can allow rogue administrative access to the N-central management interface and facilitate command execution as root. The company is currently working on a hot fix to address the vulnerabilities.
Related
