N-able Takes N-central Offline After Researcher Discloses 30+ Alleged Zero-Days
Summary
N-able took hosted N-central environments offline and advised on-premises customers to do the same after Sean Bales published 30+ alleged vulnerabilities and proof-of-concept exploits. N-able is developing a hotfix and reports no active exploitation.
Key points
- Researcher Sean Bales published the Able2Shell repository with proof-of-concept exploits for more than 30 reported N-central vulnerabilities.
- The flaws include authentication bypass, credential disclosure, file-write, directory-traversal, XSS, XXE, and RCE vulnerabilities.
- A reported unauthenticated XXE exploit chain could reset an account password, create a rogue administrator account, and execute commands as the nable user.
- The researcher tested the flaws on pre-release N-central Appliance 2026.4.0.31 and believes earlier versions may also be affected.
- N-able took hosted N-central environments offline worldwide and advised on-premises customers to temporarily shut down their servers.
- N-able is developing and validating a hotfix; it says it has found no evidence of active exploitation or unauthorized data access.
- BleepingComputer has not independently verified all reported vulnerabilities; N-able did not address the researcher's separate allegations about earlier vulnerability reports.
Article Details
- Vulnerability Types
- Authentication bypass
- Credential disclosure
- Arbitrary file write
- Directory traversal
- Cross-site scripting (XSS)
- XML external entity (XXE) injection
- Remote code execution
- Privilege escalation
- Severity
- Critical
- Affected Versions
- N-central Appliance 2026.4.0.31
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- unavailable
- Workarounds
- N-able took hosted N-central environments offline and advised on-premises customers to temporarily take their servers offline until further notice.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe unauthenticated XXE exploit chain can execute commands on the N-central server as the nable user.T1068 · Exploitation for Privilege EscalationA disclosed privilege-escalation flaw allows code running as the nable account to execute commands as root.T1136.001 · Local AccountOne disclosed exploit can create an enabled Default Administrator account with attacker-controlled credentials in the N-central management interface.