Security researcher Sean Bales has publicly disclosed more than 30 alleged zero-day vulnerabilities in N-able's N-central remote monitoring and management platform, including exploits that could allow attackers to take over vulnerable systems. N-able responded by taking its hosted N-central environments offline across the Americas, Europe, and Asia-Pacific and advising on-premises customers to shut down their servers. The company said it is developing a hotfix and has found no evidence of active exploitation.
N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) and IT teams to monitor, manage, and secure customer devices and networks. Bales released proof-of-concept exploits in a GitHub repository called Able2Shell late Sunday, November 8, and confirmed to BleepingComputer that the discovery was AI-assisted.
The disclosed vulnerabilities include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity (XXE) injection, and remote code execution (RCE) flaws. One of the most critical exploit chains uses an unauthenticated XXE vulnerability in N-central's service-import functionality to steal a trusted local session, reset an account password, and execute commands on the server as the nable user. The same exploit can create an enabled Default Administrator account with attacker-controlled credentials, providing rogue administrative access. Bales shared a video demonstration showing terminal output reporting successful administrator account creation and remote command execution.
N-able confirmed it is developing a hotfix to address the security issues. "N-able is actively responding to non-responsible communication of critical vulnerabilities in N-central late Sunday night, November 8, found by an independent researcher," the company told BleepingComputer. "As a precautionary measure, we took our Hosted N-central environment offline today, November 9, and provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice." A subsequent status update said there was no evidence of active exploitation or unauthorized data access, and that Ecoverse services accessed through N-able Login remain operational while the N-central classic environment is unavailable.
Bales said he released the vulnerabilities without prior notification to N-able because the company allegedly did not address two unrelated RCE vulnerabilities and a privilege-escalation flaw he reported five to six months ago, which remain unpatched. Bales claimed he sent follow-up emails over the past four to six weeks without a response. "I did not disclose any of the 0-days I posted last night," Bales said, adding that the current exploits target a different N-able product than the one he previously reported on. Bales confirmed that N-able executives, including the CEO and CTO, have contacted him since the disclosure and asked him to remove the GitHub repository and work with the company. "They did not threaten me or anything though. Only asked to take down the repo, work with them, etc."
N-able did not respond to questions about the previous vulnerabilities when asked by BleepingComputer.
Analysis
Why This Matters
- The vulnerabilities in a widely used remote monitoring platform could give attackers access to the systems of managed service providers, potentially compromising multiple customer networks.
- The researcher's decision to publish without prior disclosure raises questions about the effectiveness of vendor vulnerability disclosure processes.
- The incident caused widespread service disruption, with N-able taking its entire cloud platform offline and advising on-premises customers to disconnect.
Background
N-able’s N-central is a remote monitoring and management platform used by managed service providers and IT teams to oversee customer devices and networks. The disclosed vulnerabilities affect N-central Appliance 2026.4.0.31, a pre-release version, and the researcher believes earlier versions are also impacted. The vulnerabilities were published on November 8 and include a range of severe flaws. N-able has not yet provided a timeline for restoring service.
Key Perspectives
N-able: The company said it is responding to the non-responsible communication of vulnerabilities, took its hosted N-central environment offline as a precaution, and is working on a hotfix. It stated it has not observed active exploitation and did not comment on the researcher's previous reports.
Sean Bales: The researcher said he published the zero-days without prior notice because N-able did not address two previous RCE vulnerabilities and a privilege-escalation flaw reported months ago, and did not respond to follow-up emails. He said the current exploits target a different product than the previously reported ones, and confirmed that N-able executives have asked him to take down the repository, without threats.
What to Watch
- The availability of a hotfix and whether it fully resolves all disclosed vulnerabilities.
- Potential exploitation attempts now that proof-of-concept code has been published.
- Whether the dispute over previous vulnerability reports leads to changes in N-able's disclosure handling.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedSean Bales publicly disclosed more than 30 alleged zero-day vulnerabilities in N-central.BleepingComputer: “N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities”
- SupportedThe disclosed exploits could allow attackers to take over vulnerable systems.BleepingComputer: “including exploits that could let attackers take over vulnerable systems.”
- SupportedN-able took hosted N-central environments offline across the Americas, Europe and Asia-Pacific.BleepingComputer: “N-able announced a critical security incident and took its hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions.”
- SupportedN-able advised on-premises customers to take their servers offline temporarily until further notice.BleepingComputer: “provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice.”
- SupportedN-able said it was responding to the vulnerabilities disclosed late Sunday, November 8, by an independent researcher.BleepingComputer: “"N-able is actively responding to non-responsible communication of critical vulnerabilities in N-central late Sunday night, November 8, found by an independent researcher,"”
- SupportedN-able said it took hosted N-central offline on November 9 as a precaution and advised on-premises customers to take servers offline.BleepingComputer: “"As a precautionary measure, we took our Hosted N-central environment offline today, November 9, and provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice."”
- SupportedN-able confirmed it was developing a hotfix to address the security issues.BleepingComputer: “N-able confirmed it is developing a hotfix to address the security issues”
- SupportedA subsequent status update said there was no evidence of active exploitation or unauthorized data access.BleepingComputer: “In a subsequent status update , N-able said it was continuing to develop and validate a hotfix and had found no evidence of active exploitation or unauthorized data access.”
- SupportedBales confirmed to BleepingComputer that discovery of the vulnerabilities was AI-assisted.BleepingComputer: “Bales also confirmed to BleepingComputer that the discovery of the vulnerabilities was AI-assisted.”
- SupportedBales said he previously disclosed two unrelated RCE vulnerabilities and a privilege-escalation flaw five or six months earlier, and that they remained unpatched.BleepingComputer: “According to Bales, he disclosed two unrelated remote code execution vulnerabilities and a privilege-escalation flaw approximately five to six months ago, but those vulnerabilities remain unpatched.”
- SupportedBales said, “I did not disclose any of the 0-days I posted last night.”BleepingComputer: ““I disclosed 2 unrelated RCEs for a different N-able product, along with a priv esc vulnerability 5 or 6 months ago. These have yet to be patched. I did not disclose any of the 0-days I posted last night,””
- SupportedBales said, “They did not threaten me or anything though. Only asked to take down the repo, work with them, etc.”BleepingComputer: “"They did not threaten me or anything though. Only asked to take down the repo, work with them, etc."”