N-able takes N-central cloud offline after 33 alleged zero-days disclosed

N-able took its hosted N-central environments offline on November 9, 2026, after a researcher publicly disclosed 33 alleged zero-day vulnerabilities in the platform. The vendor also told customers running on-premises N-central servers to shut them down temporarily until further notice. N-able said it had not observed active exploitation of the vulnerabilities as of November 9 at 15:15:00 UTC.

A researcher disclosed the flaws on November 8, 2026, in a GitHub repository called Able2Shell. Testing targeted N-central Appliance 2026.4.0.31, a pre-release version, and the researcher said the vulnerabilities likely affect earlier releases too. N-able is developing a hotfix and expects to make it available soon without providing an exact restoration date.

The disclosed flaws can be chained into four exploits, three yielding remote code execution and one yielding privilege escalation to root. One chain uses an unauthenticated XML external entity flaw in service-import to steal a session, reset a password, and create an administrator account. That chain also executes commands on the server as the nable user.

Another disclosed path lets an administrator viewing malicious patch metadata trigger a stored cross-site scripting flaw that executes commands as root. A separate privilege-escalation flaw lets code running under the nable account execute commands as root.

The researcher identified the unauthenticated XML external entity-to-remote-code-execution chain as the most critical disclosed vulnerability. A video demonstration shared by Bales shows administrator account creation, authentication, access to protected functionality, and remote command execution under the nable user. An unauthenticated XXE exploit chain can also let an attacker create an enabled Default Administrator account using credentials the attacker controls.

ISMG listed additional exploit chain techniques including XXE/NCI trust abuse, support-token theft, unsigned NSP execution, XSS-to-OGNL, authenticated reverse shells, MDM impersonation, audit tampering, and privileged-helper injection. The research also describes a native GenericTCP stack overflow that can achieve root command execution. Field Effect pointed to a specific Python proof-of-concept file, anonymous_xxe_nable_rce.py, that appears to show an unauthenticated XML External Entity vulnerability chainable into Remote Code Execution. Field Effect’s published proof-of-concepts indicate that chained exploits could alter system settings, enumerate accounts, modify audit records, disrupt remote-control sessions, and impersonate devices.

N-central is a remote monitoring and management platform used by managed service providers and IT teams to monitor and manage customer devices and networks. A compromised N-central server could give attackers access to managed endpoints, credentials, scripts, automation, and downstream customer networks.

Sources disagree on the researcher’s identity. BleepingComputer and Undercode News name Sean Bales, an application security consultant who announced the dump in a Monday post on LinkedIn. Field Effect and TechTarget attribute the disclosure to Oracle-Security or BinaryNinja. BleepingComputer said it had not independently verified all the reported vulnerabilities.

The researcher disclosed the flaws without notifying N-able first, citing allegedly unpatched vulnerability reports in a different N-able product. He alleges he reported two unrelated remote code execution flaws and a privilege-escalation flaw about five to six months earlier, and they remain unpatched. He also alleges colleagues and he sent about five follow-up e-mails during a four-to-six-week span without getting a response.

Bales said N-able’s bug bounty platform paid nothing for his earlier reports. Reported vulnerabilities allegedly remain unpatched and are absent from the publicly released Able2Shell repository.

N-able executives, including the CEO and CTO, contacted the researcher after disclosure and asked him to remove the repository and work with them. N-able did not respond to questions about the researcher’s prior allegations when asked by BleepingComputer.

The researcher confirmed that artificial intelligence assisted in discovering the vulnerabilities. Among the disclosed issue types are remote code execution, XML external entity injection, cross-site scripting, directory traversal, arbitrary file writes, credential disclosure, and authentication bypasses.

N-able previously addressed other N-central vulnerabilities in 2026, including CVE-2026-18556, CVE-2026-18577, CVE-2026-86218, and CVE-2026-86206 and CVE-2026-86207. CVE-2026-86218 is a pre-authentication remote code execution zero day with a 10.0 CVSS score and was added to CISA’s Known Exploited Vulnerabilities catalog. Threat actors exploited CVE-2026-18577 in July and August 2026 to gain administrative access and pivot to managed systems. Huntress produced a proof of concept for a chain involving CVE-2026-86206 and CVE-2026-86207 that allowed creation of unauthorized administrative accounts.

The company said it would publish updates every four hours, or sooner if new information becomes available. N-able spokesperson Sarah Toomey said the company is actively responding now to the incident. N-able declared an active incident on Monday at 15:15 UTC amid a major outage of its hosted N-central services. A later status update from N-able said the investigation uncovered no signs of active exploitation or unauthorized access to data.

The company took its hosted N-central environments offline in the Americas, Europe, and Asia-Pacific regions. While the hosted N-central classic environment is unavailable, Ecoverse services accessed through N-able Login remain operational.

The company’s platform serves more than 500,000 organizations worldwide. N-able is based in Burlington, Massachusetts. In Aug. 2026, researchers tied a new ransomware strain to hackers linked to China, tracked as Storm-1175, after they targeted a critical vulnerability in N-able’s RMM tool.

According to Previdian, a threat intelligence firm, the proof of concept shows a full remote code execution chain running from XML external entity to command execution. Previdian founder Ryan Dewhurst said his honeypot network had seen no exploitation attempts but expected them to change quickly. Dewhurst said attackers need a few hours to test and weaponize the proof of concept.

Field Effect recommends restricting access to dedicated administration networks and verifying whether attackers can reach N-central management interfaces from the public internet. Field Effect also says defenders should review automation policy changes, remote-control sessions, script execution, software deployments, configuration modifications, privilege changes, administrator account creation, and authentication activity in N-central.

Huntress is actively investigating the incident and communicating with potentially vulnerable customers. Organizations should review login and authentication activity from November 8 onward and examine audit logs for secondary indicators of compromise.

N-able does not always change version numbers for live hotfixes that do not require a reboot, so the patched version may not be numbered 2026.4.0.31. N-able’s hotfix would be its fifth emergency hotfix since August 1, 2026.

In a now-deleted comment, Bales suggested that many if not all the vulnerabilities will work on released versions too. Coordinated vulnerability disclosure typically involves 90 days between private notification and public release of details. RMM tools such as N-central are repeat targets for ransomware and nation-state groups because one compromise can expose hundreds or thousands of downstream systems.