N-able Takes Hosted N-Central Offline After Vulnerability Disclosures

N-able has taken its hosted N-Central service offline while it works to address dozens of publicly disclosed zero-day vulnerabilities involving its systems, disrupting customer remote access and prompting a warning to self-hosted operators.

N-Central lets business customers remotely access and manage devices and systems on their networks. With the hosted service offline, customers cannot use that offering. N-able also urged customers running self-hosted N-Central deployments to take them offline because attackers could use the public exploits to reach customer networks.

Security researcher Ben Bales published the vulnerabilities on GitHub on Sunday. In a separate post on X, he dubbed them “Able2Shell” and described flaws that could steal credentials, create administrator accounts and gain root access on affected N-able systems.

N-able has found no evidence of successful exploitation in customer environments. The hosted service remains offline while the company secures the environments and carries out remediation. N-able described its response as an effort “to secure the environments and implement appropriate remediation.”