N-able N-central zero-day flaws
N-able took hosted N-central environments offline after researcher Sean Bales disclosed 33 zero-day flaws with proof-of-concept code. The company has released patches and brought hosted environments back online, but is investigating new flaws in on-premise N-central 2026.4.1 HF2.
IllustrationThe story so far
On November 9, N-able took hosted N-central environments offline across the Americas, Europe and Asia-Pacific after researcher Sean Bales disclosed more than 30 alleged zero-day flaws. Bales published proof-of-concept exploits, including an unauthenticated XML external entity flaw that could lead to remote code execution and a rogue administrator account. On November 10, N-able said it had not observed active exploitation and expected a hot fix around midday.
On November 11, N-able released hotfixes for the zero-day vulnerabilities in its N-central remote monitoring and management platform. The company had taken all hosted N-central environments offline across the Americas, Europe and Asia-Pacific until patches could be applied. Threat intelligence firm Defused reported that attackers had already started scanning for vulnerable systems. On November 12, N-able said it brought hosted environments back online after resolving vulnerabilities exploitable without authentication and advised on-premises deployments to update to N-central 2026.4 HF2.
Also on November 12, N-able said it was investigating new flaws in on-premise N-central 2026.4.1 HF2, disclosed by Bales as 4EverAble2Shell and Agent2Shell. The issues can enable unauthenticated remote code execution with root privileges and command execution on managed Windows agents as NT AUTHORITY\SYSTEM. N-able said the server issue depends on a non-default Legacy API exposed to the internet and urged customers to disable it, adding that hosted environments are not affected.
Latest updates
5 updates · newest first- 12 NovNew development
New N-central Exploits Work Against Patched Servers
N-able is investigating new flaws in on-premise N-central 2026.4.1 HF2, disclosed by Sean Bales as 4EverAble2Shell and Agent2Shell. The issues can enable unauthenticated remote code execution with root privileges and command execution on managed Windows agents as NT AUTHORITY\SYSTEM. N-able said the server issue depends on a non-default Legacy API exposed to the internet and urged customers to disable it; hosted environments are not affected.
The Hacker News ↗
- 12 NovNew development
N-able Rushes Patches for N-central Zero-Days After Public PoC
N-able released patches for several N-central zero-days after researcher Sean Bales published details and proof-of-concept code for more than 30 flaws he called Able2Shell. The company took hosted environments offline on Monday, then brought them back online after resolving vulnerabilities exploitable without authentication. It said attackers are probing exposed instances and advised on-premises deployments to update to N-central 2026.4 HF2.
SecurityWeek ↗
- 11 NovNew development
N-able releases hotfixes for zero-day vulnerabilities in N-central
N-able released hotfixes for zero-day vulnerabilities in its N-central remote monitoring and management platform, which were publicly disclosed over the weekend. The company took all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific until patches could be applied. Threat intelligence firm Defused reported that attackers have already started scanning for vulnerable systems.
BleepingComputer ↗
- 10 NovNew development
N-able takes N-central offline after 33 zero-days disclosed with exploit code
N-able said it temporarily took its hosted N-central environment offline and urged on-premises customers to shut down servers until further notice after a researcher disclosed 33 flaws, dubbed Able2Shell, with proof-of-concept exploits. The researcher is identified as Sean Bales, or by the alias BinaryNinja. N-able said it had not observed active exploitation and was working on a hot fix expected around midday on November 10.
Cybernews ↗
- 9 NovNew development
N-able takes N-central offline after 30+ zero-days published
N-able took its hosted N-central environments offline across the Americas, Europe and Asia-Pacific and urged on-premises customers to shut down servers after researcher Sean Bales disclosed more than 30 alleged zero-day flaws. Bales published proof-of-concept exploits, including an unauthenticated XML external entity flaw that can lead to remote code execution and creation of a rogue administrator account.