N-able N-central Offline After 33 Zero-Day Vulnerabilities Disclosed

• •Over 30 zero-day vulnerabilities disclosed in N-able's N-central platform.
• •N-able took its hosted services offline and advised on-premises customers to do the same.
• •No active exploitation confirmed, but a hotfix is expected on November 10.

On November 8-9, 2026, security researcher Sean Bales disclosed over 30 zero-day vulnerabilities in N-able's N-central platform, publishing proof-of-concept (PoC) exploits in a GitHub repository called Able2Shell. The vulnerabilities include unauthenticated XML External Entity (XXE) injection and remote code execution (RCE) flaws, which could allow attackers to hijack sessions, create rogue administrator accounts, and gain full control over managed environments. In response, N-able took its hosted N-central services offline globally and advised on-premises customers to do the same. As of November 10, N-able reported no confirmed active exploitation of the vulnerabilities but is working on a hotfix expected to be released the same day. The vulnerabilities could have significant impacts on managed service providers (MSPs) using the platform, as compromising a single instance could lead to widespread access across multiple client environments.