Sean Bales

N-able Takes N-central Cloud Platform Offline After Researcher Publishes 30+ Zero-Day Exploits

N-able has taken its hosted N-central environments offline worldwide and advised on-premises customers to shut down servers following the public disclosure of more than 30 alleged zero-day vulnerabilities by security researcher Sean Bales. The flaws, detailed in a GitHub repository named Able2Shell, include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, XSS, XXE injection, and remote code execution issues affecting N-central Appliance 2026.4.0.31 and likely earlier versions. One critical exploit chain uses an unauthenticated XXE vulnerability to steal sessions, reset passwords, create administrator accounts, and execute commands as the nable user or root. Bales released the details without prior notification to N-able, citing the company's alleged failure to address previous vulnerability reports from five to six months ago. N-able confirmed it is developing a hotfix, stated no evidence of active exploitation has been found, and continues to provide status updates every four hours while keeping hosted services offline.