N-able takes N-Central offline after zero-day flaws go public

In a website status update, N-able said the hosted service was unavailable while it worked to secure environments and apply remediation. Customers cannot use N-Central during the outage. The product lets organizations remotely access and manage devices and systems on their networks, making exposed remote-access tools a potential route into internal systems and data.

Bales published the flaws on GitHub on Sunday and called them “Able2Shell” in a post on X. He described a combination of vulnerabilities that could allow attackers to steal credentials, create administrative accounts and gain root access to affected N-able systems. Bales told Bleeping Computer that he released the details publicly because, he alleged, N-able had failed to patch flaws he reported in a different product.

N-able said it had no evidence that any customer environment had been successfully exploited. A company spokesperson did not respond to a request for comment on whether N-able could check for exploitation using server logs or lacked a way to do so.