N-able has taken its hosted N-central remote monitoring and management (RMM) platform offline worldwide and shipped an emergency hotfix after a security researcher released 33 zero-day exploits for the software, including attack chains that could let unauthenticated attackers take over servers.
N-central is used by managed service providers (MSPs) and enterprise IT teams to remotely manage, patch, and support endpoint systems, so a compromised server can expose every computer under its control. N-able said it took the hosted environments offline as a precaution and advised customers using the on-premises version to shut down their servers until it released the fix, N-central 2026.4 HF2, on Tuesday.
The vulnerabilities were disclosed late Sunday by an offensive security researcher named Sean Bales who uses the GitHub handle Oracle-Security. The release includes proof-of-concept exploit chains that require no authentication and could result in command execution as the service account and, in some cases, root access.
