N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
Summary: N-able took its Hosted N-central environment offline and told on-premises customers to shut down their servers after researcher Sean Bales publicly disclosed more than 30 vulnerabilities, tracked as Able2Shell, with proof-of-concept exploits tested against N-central Appliance 2026.4.0.31. The flaws include credential disclosure, arbitrary file writes, directory traversal, XSS, XXE injection and RCE, and N-able has released N-central 2026.4 HF2 while saying it has seen scanning activity tied to the published PoC code but no evidence of successful exploitation in customer environments.
Bottom line: Censys counts 1,728 internet-exposed N-central instances, and Previdian recorded 68 exploitation attempts against a single honeypot from one IP address within about 18 hours of publication - while watchTowr and Defused Cyber report probing and anonymous agent sessions against honeypots overnight.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026