N-able Takes N-central Offline After Researcher Drops 33 Zero-Days
N-able has temporarily taken its hosted N-central platform offline and urged on-premises customers to do the same following the simultaneous public disclosure of 33 zero-day vulnerabilities.
N-able is grappling with a significant security incident after an independent researcher on Monday released 33 zero-day vulnerabilities affecting its N-central remote monitoring and management platform. In response, the vendor declared an "active incident" and took its hosted N-central environment offline as a precautionary measure to secure the system and implement remediation.
The company strongly advised all customers utilizing on-premises versions of N-central to also temporarily disconnect their servers until further notice. N-central is a widely adopted tool used by managed security providers (MSPs) to administer IT infrastructure for their clients, making this disclosure a critical concern for a broad customer base.
Despite the large number of disclosed vulnerabilities, N-able stated that it has not yet observed any active exploitation in the wild. The company is reportedly working on an emergency hotfix, which is expected to be released soon. This marks the fifth such emergency fix for the vendor since early August, indicating a challenging period for their product security.
The vulnerabilities were published on GitHub by application security consultant Sean Bales, who dubbed the collection "Able2Shell." Bales claimed that all exploits were tested on the latest pre-release version of N-central and suggested they would likely work on previous versions as well. The disclosed flaws reportedly enable anonymous credential theft, administrator account creation, and remote code execution (RCE).
Bales detailed exploit chains involving XML External Entity (XXE) injection, NCI trust abuse, support token theft, unsigned NSP execution, Cross-Site Scripting (XSS) to OGNL injection, and authenticated reverse shells. Proof-of-concept exploits were also provided, demonstrating capabilities such as arbitrary file writes, directory traversal, credential disclosure, mobile device management (MDM) impersonation, audit tampering, and privileged-helper injection. A native GenericTCP stack overflow was also highlighted, capable of achieving root command execution.
This mass disclosure highlights a growing trend where AI-assisted tools are enabling researchers to discover vulnerabilities and proof-of-concept exploits at an unprecedented rate, often overwhelming vendors. Remote monitoring and management (RMM) tools like N-central are frequent targets for attackers, including ransomware gangs and nation-state actors, due to the potential for widespread access to downstream systems through MSP compromises.
N-able's situation comes after a previous incident in August where a new ransomware strain was traced to financially motivated hackers linked to China, who may have exploited a critical vulnerability in N-able's RMM tool. The current disclosure by Bales appears to be an uncoordinated vulnerability disclosure, as there is no immediate indication of prior discussions with N-able to allow for a patched release before public announcement.
The practice of "coordinated disclosure," where vendors are given a window to fix flaws before public release, is standard in the industry. However, when vulnerabilities are actively exploited, researchers may opt for immediate disclosure. The rapid release of 33 zero-days without prior vendor notification presents a significant challenge for N-able and its extensive customer network.