By Hamza Faisal
N-able has taken its hosted N-central platform offline worldwide after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities in the remote monitoring software, complete with working proof-of-concept exploits.
The company declared a critical security incident on Monday, November 9, pulling its hosted N-central environments offline across the Americas, Europe, and Asia-Pacific. It also urged customers running N-central on their own servers to shut those systems down until further notice while engineers work on a fix.
N-central is a remote monitoring and management (RMM) platform used by managed service providers and IT teams to monitor, manage, and secure customer devices and networks remotely — which is what makes the disclosure so serious. A flaw in an RMM tool can hand an attacker the keys to every machine the platform manages.
What the researcher disclosed
Security researcher Sean Bales, who publishes under the handle BinaryNinja, disclosed the flaws late on Sunday, November 8, posting a GitHub repository called Able2Shell containing vulnerability details, technical write-ups, screenshots, and proof-of-concept code. TechTarget put the count at 33 critical zero-days; BleepingComputer described the total as more than 30.
According to reports, the flaws include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity injection, and remote code execution. Bales told BleepingComputer the most critical chain is an unauthenticated XXE flaw that can be chained into full remote code execution.
Bales said he tested the vulnerabilities against N-central Appliance 2026.4.0.31, a pre-release build of the software, and believes most — if not all — of the flaws also affect earlier versions. He also confirmed that artificial intelligence assisted in discovering the vulnerabilities, another sign of how quickly AI-assisted security research is now moving.
N-able's response — and the dispute behind it
In a security alert, N-able said it was responding to a "public disclosure and non-responsible communication of critical vulnerabilities in N-central." The company said it had not observed active exploitation of the flaws and had found no evidence of unauthorized data access, and that a hotfix is being developed and validated.
N-able has not given an estimate for when the hosted platform will return, but says it will publish updates every four hours, or sooner if new information becomes available.
Bales told BleepingComputer the public disclosure came after five to six months of unaddressed vulnerability reports about a different N-able application — a reminder that how vendors handle private reports shapes whether researchers go public. He also said vulnerabilities he had previously reported to the company are not included in the Able2Shell repository and allegedly remain unpatched.
What customers should do now
For now, the advice from N-able is blunt: hosted customers wait, and on-premises customers keep their servers offline until a hotfix lands. No CVE identifiers or severity scores have been published for the flaws yet, so customers have little to triage on beyond the company's shutdown guidance.
The incident is the latest reminder that the tools IT teams rely on to manage other people's systems are themselves high-value targets — and that when a disclosure lands with working exploits attached, taking the platform dark is sometimes the only safe move.
