N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits Ravie LakshmananNov 10, 2026Vulnerability / Enterprise Security N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell. "As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the environment and implement appropriate remediation," N-able said. "During this time, customers will be unable to access their Hosted N-central classic environment, and associated services may be unavailable. However, the Ecoverse services under N-able Login remain available and online, including Asset View, Patching, Vulnerability Management, scripting, policies and tagging." The company also said it has not observed any signs of active exploitation of these vulnerabilities, adding it's currently working on a hot fix to address them. The development comes as independent security researcher Sean Bales disclosed multiple security flaws along with proof-of-concept (PoC) exploits. The researcher said the issues were tested against N-able N-central Appliance 2026.4.0.31. The identified zero-day vulnerabilities include credential disclosure, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity (XXE) injection, and remote code execution (RCE) flaws - Multiple N-central zero-days enable anonymous credential theft, administrator creation, and nable/root RCE. Chains include XXE/NCI trust abuse, support-token theft, unsigned NSP execution, XSS-to-OGNL, and authenticated reverse shells. Arbitrary file writes, traversal, credential disclosure, MDM impersonation, audit tampering, and privileged-helper injection. A native GenericTCP stack overflow also achieves root command execution Successful exploitation of these flaws can allow rogue administrative access to the N-central management interface and facilitate command execution as root. watchTowr, in a post shared on X, said it "observed exploitation attempts against N-able N-central honeypots overnight following the 'Able2Shell' zero-days being dropped." The preemptive exposure management firm is urging users to audit for signs of compromise, restrict access, and follow vendor guidance on mitigation steps. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cybersecurity, enterprise security, network security, remote code execution, Vulnerability Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out The Flood is Coming And The Pipes Were Already Full Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Attend Live Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk