N-able pulls its remote management platform offline after a researcher publishes dozens of zero-day exploits

N-able pulled its hosted N-central environments offline on November 9, 2026, across the Americas, Europe, and Asia-Pacific regions, advising on-premises customers to temporarily shut down their servers as well. The move followed security researcher Sean Bales publicly dropping more than 30 zero-day flaws late Sunday, November 8, alongside a GitHub repository called Able2Shell that contained proof-of-concept exploits. Tested against pre-release appliance version 2026.4.0.31, the vulnerabilities could enable remote code execution, credential theft, and unauthorized administrative account creation. [2][3]

According to Bales, who noted the bug discovery was AI-assisted, the weaknesses span authentication bypasses, directory traversal, and arbitrary file writes. The primary exploit chain leverages an unauthenticated XML external entity flaw in N-central's service-import feature to reset passwords, execute commands as the nable user, and create rogue Default Administrator accounts. Other exploits include stored cross-site scripting that triggers commands as root through malicious patch metadata. N-able reported no evidence of active in-the-wild exploitation or unauthorized data access, clarifying that Ecoverse services accessed through N-able Login remain operational. [2][3]

N-able confirmed it is developing and validating a hotfix to remediate the vulnerabilities, though it has not provided a timeline for restoring the service. Bales told BleepingComputer he released the exploits without prior notice because N-able allegedly left two remote code execution flaws and a privilege-escalation vulnerability he reported five to six months ago in a different product unpatched. Following the public disclosure, N-able executives reached out to request that Bales take down the GitHub repository and collaborate with the company. [3]