N-able spent Monday with its own product switched off. That was the fix — or at least the only one available — after a security researcher published 33 zero-day vulnerabilities in N-central, the remote monitoring platform MSPs use to run their customers' networks, along with working exploit code and no advance warning to the vendor.
The disclosure, dubbed "Able2Shell," landed on GitHub late Sunday from independent researcher Sean Bales, who tested the flaws against a pre-release build and says most or all likely affect earlier versions. The bugs chain into four exploits — three ending in remote code execution, one in root access — and the worst starts with an unauthenticated flaw that lets an attacker hijack a session, reset credentials, and create a rogue administrator account. Bales says AI helped find the flaws, and according to TechCrunch, he told BleepingComputer he went public deliberately, after N-able allegedly spent months failing to patch flaws he had reported in a different product.
N-able's response was the nuclear option. On Monday it declared a critical security incident, took hosted N-central offline across the Americas, Europe, and Asia-Pacific, and told on-premises customers to shut their servers down too. In its status update, the company called the disclosure "public disclosure and non-responsible communication of critical vulnerabilities" and said it had seen no evidence of successful exploitation. That line is thinning: N-able has since confirmed it is seeing "scanning activity associated with the published proof-of-concept code," and The Hacker News reports watchTowr saw exploitation attempts against its N-central honeypots overnight.
The hotfix arrived Tuesday. N-able released N-central 2026.4 HF2, which covers seven newly assigned CVEs — the XXE flaws, injection bugs, a stored XSS flaw, and the RCE chain — and says all hosted servers are updated. On-premises customers must upgrade servers, agents, and probes, keeping everything offline until done, according to Huntress.
The bigger story is the pattern. This is N-central's third emergency of 2026, after an unauthenticated "god-mode" flaw in August and an actively exploited pre-auth RCE bug scored 10.0 in September. Remote monitoring tools are the skeleton key to thousands of client networks at once — the ConnectWise compromise last month reached 2,250 Microsoft 365 tenants — which is why a public dump with working exploits forced the vendor to switch its cloud off. The hotfix is out; the question is how many on-premises servers come back before the scanners find them.
— via TechCrunch