N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline.
This follows N-able’s decision to take all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions until it could patch them against potential attacks targeting the zero-day flaws in the wild.
“N-able is actively responding to non-responsible communication of critical vulnerabilities in N-central late Sunday night, November 8, found by an independent researcher,” N-able told BleepingComputer on Monday. “As a precautionary measure, we took our Hosted N-central environment offline today, November 9, and provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice.”
N-central lets IT departments and managed service providers (MSPs) monitor, manage, and maintain client networks and devices from a centralized web-based console.
N-able has now released N-central 2026.4 HF2 with security patches and technology updates for some of the leaked zero-days, including “the most critical” vulnerabilities:
In a Tuesday update, N-able said that all hosted N-central servers (NCODs) across all regions have now been successfully upgraded and advised and “strongly” recommended that all N-central On-Premises customers upgrade their installations to the newly released version “as soon as possible.”
“Customers should follow the published upgrade guidance carefully before restoring normal access to their N-central environment. Earlier incident guidance advised On-Premises customers to keep their N-central servers offline while remediation was being developed,” it said.
While N-able has yet to flag these flaws as exploited in the wild, threat intelligence company Defused said on Tuesday that attackers have already started scanning the Internet for vulnerable systems and warned admins to take N-central servers offline immediately.
“During the past 24 hours, we have observed probing of N-able N-central for the 0-days that were dropped publicly yesterday,” Defused said. “We have seen opening of anonymous agent sessions, pulling appliance config and hitting the remote control endpoint without auth. These pathways are part of the 0-day exploit surface.”
Internet security nonprofit Shadowserver reports that just over 148 N-central servers are currently exposed online, a sharp decrease from the 1,338 it detected on Monday.
Disclosed after previous reports were allegedly ignored
Security researcher Sean Bales disclosed the vulnerabilities late Sunday, November 8, and published a GitHub repository called Able2Shell containing proof-of-concept exploits for the flaws.
Bales said the zero-day bugs affect N-central Appliance 2026.4.0.31, a pre-release version of the software, and believes that most (if not all) of the flaws also affect earlier versions.
The disclosed vulnerabilities include remote code execution (RCE), authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, XML external entity (XXE) injection, and cross-site scripting (XSS) flaws.
The security researcher also demoed a critical unauthenticated XXE-to-RCE exploit chain that abuses N-central’s service-import functionality to steal a trusted local session, reset the targeted account’s password, and execute commands on the server as the nable user.
Attackers could also use this exploit to create a Default Administrator account with attacker-controlled credentials, which provides them rogue admin access to the N-central management interface, as shown in the video demo embedded below.
Bales told BleepingComputer that he released the N-central zero-days without notifying N-able because the company allegedly failed to patch vulnerabilities (including two unrelated remote code execution bugs and a privilege-escalation flaw) he reported in a different N-able product about five to six months ago.
When asked about Bales’ allegations regarding the previously disclosed security issues, N-able did not address the questions and instead responded with a statement about the N-central security incident and precautionary shutdown.
N-able provides cloud-based remote monitoring, cybersecurity, and data protection tools for Managed Service Providers (MSPs) and enterprise IT departments at more than 500,000 organizations in over 140 countries.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.
