N-able takes N-central offline after 30+ zero-days go public

Your IT provider's master console just went dark. N-able took every hosted N-central environment offline on November 9 and told on-premises customers to shut their servers down too, after a researcher published exploits for what he says are more than 30 zero-day flaws. N-central is a remote monitoring and management (RMM) tool. Managed service providers use it to patch, script and remote into their clients' machines. If you pay an MSP, it may be the tool that manages your laptops.

What actually happened

Security researcher Sean Bales published a GitHub repository called Able2Shell late Sunday, November 8, with proof-of-concept exploits, BleepingComputer reported. He told the outlet the research was AI-assisted.

• The worst chain. An unauthenticated XXE flaw in N-central's service-import feature steals a trusted local session, resets a password and runs commands on the server. It can also create an enabled admin account with credentials the attacker picks.
• What he tested. N-central Appliance 2026.4.0.31, a pre-release build. He believes most of the flaws also hit earlier versions.
• N-able's response. Its status page lists a major outage for hosted N-central in the Americas, Europe and APAC, starting 15:15 UTC. On-prem customers should keep servers offline "until further notice." As of the 3 p.m. EST update: no evidence of active exploitation or data access, a hotfix in progress, no restoration estimate.
• What still works. Asset View, patching, vulnerability management and scripting through N-able Login at n-able.app.
• The backstory. Bales says he skipped coordinated disclosure because two RCEs and a privilege-escalation bug he reported in a different N-able product months ago remain unpatched. N-able didn't answer BleepingComputer's questions on that.

Why it matters for your business

You don't run N-central. Your MSP does. And an RMM console is the master key to every endpoint it manages. That's why N-able pulled the plug instead of waiting. It's also the third N-central security event we've covered since August, after CVE-2026-18577 and CVE-2026-86218.

Send your MSP four questions today:

1. Do you use N-central, hosted or on-prem? If on-prem, is it offline right now?
2. What's the fallback this week? Patching and remote support still have to happen.
3. When it comes back, will you apply the hotfix and check for admin accounts you didn't create?
4. Who else holds keys to our machines? Get the list in writing.

Sources: BleepingComputer, N-able status page.