Researcher discloses over 30 flaws in N-able N-central

N-able took its hosted N-central environments offline on 10 November 2026 after security researcher Sean Bales publicly disclosed more than 30 alleged zero-day vulnerabilities, code-named Able2Shell. N-able said the precautionary step was to secure the environment and implement remediation, with an update indicating the fix was being validated and would roll out around midday that day. The company also advised customers with on-premises N-central deployments to keep those offline until patches are released. N-able asserted there is no evidence that the vulnerabilities have been exploited against its N-central environments.

Bales published five exploit chains and PoC code targeting every flaw, describing weaknesses that could enable remote code execution with either “nable” or root privileges, arbitrary command execution, creation of unauthorized administrative accounts, or leakage of sensitive data such as configurations and credentials. The flaws were published on GitHub on a Sunday and had not yet been assigned CVE identifiers at the time of reporting.

Bales termed the flaws Able2Shell and indicated the issues stemmed from security defects he had previously reported in another product. N-able stated it is progressing with a hotfix and validation activities, with all work on track to deliver a safe remediation.