N-able takes cloud N-Central offline after researcher publishes dozens of zero-day flaws
N-able has taken its cloud-hosted N-Central remote-management service offline after researcher Ben Bales published dozens of previously unpatched flaws on GitHub on Sunday, without giving the company advance notice. In a website status update, N-able said the hosted offering will stay down while it secures environments and applies remediation. It also urged customers running self-hosted N-Central to shut those servers down, warning that publicly disclosed exploits could be used against customer networks. During the outage, customers cannot use N-Central, which lets companies remotely access and manage devices and systems on the same network — a class of tools that attackers often target because of the broad access they confer.
Bales branded the issues Able2Shell, describing a mix of bugs that can steal credentials, create new administrative accounts, and gain root access on affected N-able systems. He told Bleeping Computer he disclosed them publicly because N-able had allegedly failed to patch flaws he had reported in a different product. N-able said it has seen no evidence of successful exploitation in customer environments; a spokesperson did not answer whether the company can actually verify that from logs. The company framed the episode as a critical security incident.
Continue in the app — vote & join in ➔