Title: N-able Takes N-central Cloud Offline After 33 Zero-Days with PoC Exploits (Able2Shell)
Summary: Independent researcher Sean Bales has published Able2Shell, a disclosure of more than 30 vulnerabilities in the N-able N-central RMM product together with proof-of-concept exploit code on GitHub; his README says all testing was done on N-able N-central Appliance 2026.4.0.31 (a pre-release build, with “most if not all vulnerabilities should work on previous versions, including the most up to date version”) and that, at the time of posting, every flaw works on the latest pre-release build and is unpatched. The 33 PoC scripts in his repo cover credential disclosure, arbitrary file writes, directory traversal, XSS, XXE injection and remote code execution, with working chains to root and admin takeover — among them pre-auth XXE chains that create administrators and execute as the nable user, a sendmail option injection executed as uid=0(root), and predictable MMS3 passcodes letting anonymous callers mint valid appliance sessions. In response, N-able said it was “temporarily taking our Hosted N-central environment offline” as a precaution, with Hosted and On-premise N-central services listed as impacted across the Americas, APAC and Europe, and urged on-premises customers to shut down their servers until further notice — while its Ecoverse services (Asset View, Patching, Vulnerability Management, scripting, policies, tagging) stay online, per The Hacker News quoting the vendor’s status site. N-able says it has not observed signs of active exploitation and is working on a hot fix; watchTowr, however, reports per The Hacker News that it “observed exploitation attempts against N-able N-central honeypots overnight” after the drop. watchTowr advises auditing systems for signs of compromise, limiting access and heeding vendor guidance; on-premises operators should keep their servers down until N-able’s hot fix lands.
References: