N-able has taken its hosted N-central environments offline and has advised on-premises clients to power down their servers after a security researcher revealed more than 30 purported zero-day vulnerabilities, some of which could allow attackers to seize control of affected systems.
On Sunday, November 8, security researcher Sean Bales made the vulnerabilities public and created a GitHub repository named Able2Shell, which includes proof-of-concept exploits for these issues.
N-central serves as a remote monitoring and management (RMM) platform utilized by managed service providers (MSPs) and IT teams to oversee, manage, and secure customer devices and networks from a distance.
Bales indicated that the vulnerabilities were tested on N-central Appliance version 2026.4.0.31, a pre-release iteration of the software, and he suspects that most, if not all, of the issues also impact earlier versions.
He also informed BleepingComputer that the identification of these vulnerabilities was aided by artificial intelligence.
The vulnerabilities disclosed encompass authentication bypasses, credential leaks, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity (XXE) injection, and remote code execution (RCE) vulnerabilities.
One of the most severe exploit chains takes advantage of an unauthenticated XXE vulnerability in N-central’s service-import feature to capture a trusted local session, reset an account password, and execute commands on the server as the nable user.
This same exploit can also establish a Default Administrator account with credentials controlled by the attacker, granting unauthorized administrative access to the N-central management interface.
Bales provided a video demonstration of this exploit, showcasing terminal output that confirms successful creation of an administrator account, login authentication, access to restricted administrative functions, and remote command execution as the nable user.
Other vulnerabilities disclosed include a stored XSS that can run commands as root when an administrator inspects malicious patch metadata, and a privilege escalation flaw that permits code executing under the nable account to run commands as root.
Bales confirmed to BleepingComputer that the unauthenticated XXE-to-RCE exploit is the most critical among the vulnerabilities disclosed.
In response to the disclosure, N-able declared a critical security incident and took its hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions.
While BleepingComputer has not independently verified all reported vulnerabilities, N-able has confirmed that it is working on a hotfix to resolve the security issues, supporting the researcher’s assertions that at least some of the flaws are genuine zero-days.
N-able stated to BleepingComputer, “We are actively responding to the irresponsible communication of critical vulnerabilities in N-central that were discovered by an independent researcher late Sunday night, November 8. As a precaution, we took our Hosted N-central environment offline today, November 9, and advised customers using on-premises N-central servers to temporarily shut down their servers until further notice.”
“Our Security, Engineering, and Operations teams are diligently working to implement the necessary fixes. Currently, we have not detected any active exploitation of these vulnerabilities. Protecting our customers and their environments is our top priority, and we will provide further updates as they become available.”
In a follow-up status update, N-able mentioned that it is still developing and validating a hotfix and has found no signs of active exploitation or unauthorized data access.
Although the N-central classic environment is currently unavailable, N-able noted that Ecoverse services accessed through N-able Login remain functional.
N-able has not provided a timeline for when N-central will be back online but has stated that it intends to issue updates every four hours or sooner if new information arises.
Source: Original article
