N-able has taken its N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice after the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell.
"As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the environment and implement appropriate remediation," N-able said. "During this time, customers will be unable to access their Hosted N-central classic environment, and associated services may be unavailable. However, the Ecoverse services under N-able Login remain available and online, including Asset View, Patching, Vulnerability Management, scripting, policies and tagging."
The company added that it has not observed any signs of active exploitation and is currently working on a hot fix. The following services are impacted: N-central (hosted version) (Americas), N-central (hosted version) (APAC), N-central (hosted version) (Europe), N-central On-premise (Americas), N-central On-premise (APAC), and N-central On-premise (Europe).
The disclosure was made by independent security researcher Sean Bales, who published multiple security flaws along with proof-of-concept exploits tested against N-central Appliance 2026.4.0.31. The zero-day vulnerabilities include credential disclosure, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity (XXE) injection, and remote code execution (RCE) flaws.
Attack chains enable anonymous credential theft, administrator creation, and nable/root RCE through techniques such as XXE/NCI trust abuse, support-token theft, unsigned NSP execution, XSS-to-OGNL, and authenticated reverse shells. Additional issues cover arbitrary file writes, traversal, credential disclosure, MDM impersonation, audit tampering, and privileged-helper injection. A native GenericTCP stack overflow also achieves root command execution.
Successful exploitation can allow rogue administrative access to the N-central management interface and facilitate command execution as root. (This is a developing story. Please check back for more details.)
