According to BleepingComputer (9 November 2026), N-able took its hosted N-central environments offline across the Americas, Europe and Asia-Pacific and urged on-premises customers to shut down their servers after a security researcher, Sean Bales, publicly disclosed more than 30 alleged zero-day vulnerabilities with proof-of-concept exploits late on Sunday 8 November.

N-able told BleepingComputer it is 'actively responding to non-responsible communication of critical vulnerabilities in N-central', that it took Hosted N-central offline on 9 November as a precaution and gave guidance to customers running on-premises N-central servers to temporarily take them offline until further notice, and that it has not observed active exploitation; in a later status update cited by BleepingComputer it said it was developing and validating a hotfix, had found no evidence of unauthorised data access, that Ecoverse services accessed through N-able Login remain operational, and that it plans updates every four hours.

BleepingComputer says it has not independently verified all the reported flaws. (source: BleepingComputer) The researcher's Able2Shell write-up says all testing was done on N-able N-central Appliance 2026.4.0.31, a pre-release version, that most if not all of the flaws should also work on earlier versions, and that at the time of posting all were unpatched; its index lists issues including an anonymous service-import XXE chain to remote code execution as the nable user, several root code-execution paths, anonymous credential disclosure and anonymous configuration overwrite. (source: Able2Shell write-up)

N-able's 9 November statements here are as quoted by BleepingComputer.

UPDATE (11 Nov 2026, Perth): N-able's release notes dated 10 November 2026 describe N-central 2026.4 Hotfix 2 (build 2026.4.1.26) as a critical security update that strengthens authentication and permission checks, removes legacy mobile device management, adds validation to file and log handling, hardens server components and Agent-Probe communication, and updates the server operating system and third-party components; N-able says on-premises customers should upgrade as soon as possible, hosted servers are upgraded by N-able, and all customers must upgrade their Agents and Probes (Agents first, then Probes), and lists built-in remote control as temporarily disabled. (source: N-able release notes)

According to BleepingComputer (11 November), N-able said in a Tuesday update that all hosted N-central servers in all regions have been upgraded; BleepingComputer lists the fixes as including CVE-2026-125883 (multiple XXE), CVE-2026-125878 (multiple OGNL injection), CVE-2026-125879 (local privilege escalation to root via syslog-ng config), CVE-2026-125880 (stored XSS), CVE-2026-125881 (SSRF), CVE-2026-125882 (RCE via file repository upload path traversal) and CVE-2026-91000 (insecure IPC channels, local privilege escalation).

N-able has not flagged the flaws as exploited; threat intelligence firm Defused said it observed probing of N-central for the published zero-days, and Shadowserver reported just over 148 exposed N-central servers, down from 1,338 on Monday, according to BleepingComputer. (sources: N-able release notes; BleepingComputer)