On November 9, 2026, N-able took its hosted N-central environments offline after security researcher Sean Bales disclosed more than 30 alleged zero-day vulnerabilities. The disclosure occurred on November 8, 2026, and included a GitHub repository named Able2Shell containing proof-of-concept exploits.
The vulnerabilities identified by Bales include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity (XXE) injection, and remote code execution (RCE). A critical exploit chain involves an unauthenticated XXE vulnerability that can be used to steal a trusted local session and execute commands on the server as the nable user.
N-able has confirmed that it is working on a hotfix to address these security issues. The company has not observed any active exploitation of the vulnerabilities at this time. N-able plans to provide updates on the situation every four hours.
Bales claims he previously reported two unrelated remote code execution vulnerabilities and a privilege-escalation flaw to N-able, which remain unpatched. He also stated that he received no payment through N-able's bug bounty platform for these earlier reports.
N-able's hosted N-central environments are currently offline across the Americas, Europe, and Asia-Pacific regions as a precautionary measure.