N-able Issues Patches for N-central Zero-Days After Researcher Publishes Able2Shell Exploits
N-able has released patches addressing multiple zero-day vulnerabilities in its N-central platform following public disclosure by researcher Sean Bales. The flaws, collectively referred to as Able2Shell, include high-severity issues such as XXE, XSS, SSRF, and path traversal leading to remote code execution. Several CVEs with scores above 8.0 were fixed in N-central 2026.4 HF2, with hosted environments restored after temporary shutdown. Active scanning activity tied to the published proof-of-concept code has been observed by both N-able and Defused, though no hosted compromises have been confirmed. The company emphasized that unauthenticated vulnerabilities are resolved while authenticated issues will receive further hotfixes. N-able also addressed claims regarding responsible disclosure practices.
SecurityWeekNov 12, 2026Translated from English