N-able has taken its hosted N-central environments offline across the Americas, Europe and Asia-Pacific and told on-premises customers to shut down their servers after a researcher published 33 vulnerabilities in the remote monitoring and management platform. N-central is used by managed service providers and IT teams to administer customer devices and networks.
The disclosure, published in a GitHub repository named Able2Shell on November 8, includes proof-of-concept code for authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity injection and remote code execution. The researcher tested the flaws against N-central Appliance 2026.4.0.31, a pre-release build, and said most or all may also affect earlier versions. N-able has not published a confirmed affected-version range.
One of the most serious chains uses an unauthenticated XML external entity flaw in the service-import function to hijack a trusted local session, reset an account password, run commands as the nable service user and create an enabled default administrator account with attacker-controlled credentials. Huntress said the 33 vulnerabilities can be combined into four exploit chains, three leading to remote code execution and one to root-level privilege escalation.
N-able confirmed the security incident and said it had not observed active exploitation or unauthorized data access as of November 9. The company is developing a hotfix, but has not given a restoration time for hosted N-central. Its official status notice tells on-premises customers to keep servers offline until the company confirms they can be safely restored. BleepingComputer’s report notes that it could not independently verify every reported flaw.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
