N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
Source SecurityWeek
Rated High by Threat Radar's AI analysis
Data as of 10 Nov 2026, 10:03 UTC
What to do
AI-suggested
N-able has taken its hosted N-central environments offline as a precaution and is actively working on validating and patching the vulnerabilities. The fix is expected to be released around midday on November 10, 2026. Until patches are available, on-premises N-central deployments should also remain offline to prevent exploitation. Organizations should apply the official patches promptly once released. There is no indication that any additional mitigation steps are required beyond applying the forthcoming patches and following vendor guidance.
Description
N-able's N-central product was taken offline after a security researcher publicly disclosed over 30 zero-day vulnerabilities, collectively named Able2Shell. These vulnerabilities could allow attackers to execute remote code with elevated privileges, steal credentials, create unauthorized administrator accounts, and leak sensitive data. The researcher released proof-of-concept code for all flaws. N-able is working on patches and has advised keeping on-premises deployments offline until fixes are available. There is no evidence of exploitation in the wild so far.