Thinking Thinking
A night shift desk with three monitors showing blurred colour, a desk phone off the hook and a dark office behind.
Illustration by Thinking

News

N-able took its hosted RMM platform offline over published zero-days

N-able shut down hosted N-central on 9 November 2026 after a researcher published more than 30 claimed zero-days, and shipped a hotfix covering seven critical CVEs two days later.

By Thinking Desk 2 min read

Key takeaways

  • Researcher Sean Bales published more than 30 claimed N-central zero-days with working exploits on 8 November 2026, and said the work was AI-assisted.
  • N-able took its hosted environment offline on 9 November and told on-premises customers to take their own servers offline until further notice.
  • N-able's release notes show hotfix HF2, build 2026.4.1.26, on 10 November, and BleepingComputer reported it covers seven critical CVEs.
  • Internet-exposed N-central instances reportedly fell from 1,338 to about 148 within days, and scanning began within 24 hours of disclosure.
On this page
  1. What happened to N-able N-central?
  2. How many vulnerabilities were actually fixed?
  3. Is the hosted platform back online?
  4. What it means for a small or mid-sized European operator

What happened to N-able N-central?

N-able pulled its hosted remote monitoring and management platform offline after a researcher published more than 30 claimed zero-day vulnerabilities in it. BleepingComputer reported that Sean Bales posted the flaws with proof-of-concept exploits on GitHub late on Sunday 8 November 2026, and that he said the discovery work was AI-assisted. N-able responded on 9 November: "we took our Hosted N-central environment offline today, November 9, and provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice." The company said it had not observed active exploitation and described itself as responding to a non-responsible disclosure.

The reported flaws include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity injection and remote code execution, and were demonstrated against the pre-release N-central appliance version 2026.4.0.31. Bales said he believed most or all also affect earlier versions.

How many vulnerabilities were actually fixed?

N-able's own release notes list N-central 2026.4 HF2, build 2026.4.1.26, dated 10 November 2026, described as "a critical security update". BleepingComputer reported on 11 November that the hotfix addressed seven critical CVEs, covering XML external entity injection, OGNL injection, local privilege escalation, stored cross-site scripting, server-side request forgery, remote code execution through path traversal and insecure inter-process communication channels. That is fewer than the 30-plus originally claimed, and the gap between the two counts has not been reconciled publicly. Treat both numbers as reported rather than settled.

A separate hotfix, HF1 build 2026.4.0.32 dated 2 November, had already patched CVE-2026-98432, a Linux kernel flaw rated CVSS 9.8, along with CVE-2026-111497 and CVE-2026-114406.

Weekly, Thursday morning, Central European Time.

The Thinking briefing

One email a week: what changed in European business software, which prices moved, and which comparison we published. No sales mail.

We store your address to send the briefing. One click unsubscribes you, and we never pass it on.

Is the hosted platform back online?

Yes. N-able said all hosted N-central servers across all regions have been upgraded and service restored, and it strongly recommends on-premises customers upgrade immediately and follow the published upgrade guidance before restoring normal access. BleepingComputer reported that researchers saw scanning for these flaws within 24 hours of disclosure and that the number of internet-exposed instances fell from 1,338 to roughly 148 within days.

What it means for a small or mid-sized European operator

Most European small firms have never heard of N-central, and that is the point: it is the tool your IT provider uses to reach your machines. A compromise of an RMM platform is a compromise of every endpoint it manages, which is why the sensible question this week is not "are we patched" but "does our provider run N-central, was it exposed to the internet, and has it been upgraded". Ask in writing and keep the answer. If the answer is yes and the server sat on a public address, assume credentials that passed through it need rotating, which is a good moment to check how your team actually stores them, see /en/best/best-password-managers-2026. Retail and hospitality operators whose tills and back office are managed remotely should also know which supplier holds that access, and our overview of /en/best/best-pos-systems-luxembourg notes who manages what.

Questions and answers

Was N-central actually exploited?
N-able said it had not observed active exploitation. BleepingComputer reported that scanning for the flaws began within 24 hours of disclosure, which is not the same as confirmed compromise. If your instance was internet-facing and unpatched in that window, investigate rather than assume.
What should a company that outsources its IT do?
Ask the provider in writing whether it runs N-central, whether the server was reachable from the internet, and whether it is now on hotfix HF2 build 2026.4.1.26 or later. If it was exposed, treat credentials that passed through the platform as needing rotation.

Sources

Every price and fact above was checked against these pages on the date shown.

  1. [1] BleepingComputer: N-able takes cloud platform offline after 30+ zero-days published accessed 2026-11-11
  2. [2] BleepingComputer: N-able releases security hotfixes for zero-day vulnerabilities accessed 2026-11-11
  3. [3] N-able status: N-central release notes accessed 2026-11-11
Topics n-ablermmmspzero-daypatching