N-able takes hosted N-central offline after more than 30 flaws are published

BleepingComputer reported on 9 November 2026 that N-able has taken its hosted N-central environments offline and advised customers who run N-central on their own servers to shut them down temporarily. The move followed security researcher Sean Bales publishing more than 30 zero-day flaws, together with proof-of-concept exploits, on GitHub late on 8 November. N-central is a platform that managed service providers and IT teams use to monitor and manage customer devices and networks remotely.

• According to the report, the disclosed issues include authentication bypasses, credential disclosure, arbitrary file writes, XXE injection and remote code execution flaws.
• The most critical chain uses an XXE flaw that needs no authentication to run commands on the server and create an administrator account chosen by the attacker.
• The researcher confirmed to BleepingComputer that AI helped him find the flaws.
• N-able said it is developing a fix and has so far seen no active exploitation or unauthorised data access.

Why it matters

Remote monitoring and management tools have administrator-level access to every device they connect to, so flaws like these can raise the risk for many client companies, not just one. Companies in Türkiye that outsource IT services may want to ask their providers whether they use N-central and whether they have followed N-able's guidance. According to the report, N-able has not said when N-central will be back online and plans to post updates every four hours.

Bales said he published the flaws without notifying the company first because flaws he had reported months earlier in a different N-able product had still not been fixed. N-able, for its part, described the publication as a non-responsible disclosure.