N-able N-central gets emergency fix two days after 33 exploits published

Publisher excerpt From CSO Online

N-able has taken its hosted N-central remote monitoring and management (RMM) platform offline worldwide and shipped an emergency hotfix after a security researcher released 33 zero-day exploits for the software, including attack chains that could let unauthenticated attackers take over servers. N-central is used by managed service providers (MSPs) and enterprise IT teams to remotely manage, patch, and support endpoint systems, so a compromised server can expose every computer under its control. N-able said it took the hosted environments offline as a precaution and advised customers using the on-premises version to shut down their servers until it released the fix, N-central 2026.4 HF2, on Tuesday. The vulnerabilities were disclosed late Sunday by an offensive security researcher named Sean Bales who uses the GitHub handle Oracle-Security. The release includes proof-of-concept exploit chains that require no authentication and could result in command execution as the service account and, in some cases, root access. N-able said it has already observed scanning activity associated with the published exploits but has not seen evidence that any customer environment has been successfully exploited. Censys found 1,728 internet-exposed N-central instances, and security firm Previdian recorded 68 exploitation attempts against one of its honeypots from a single IP address within about 18 hours of the publication. Exploit chains lead to remote code execution The 33 exploits, which the researcher dubbed Able2Shell, are organized into four attack chains. The most severe requires no authentication and abuses an XML external entity (XXE) flaw in a service-import function to steal a trusted local session, reset an account password, and execute commands as the nable service user. The same chain can create a Default Administrator account with credentials chosen by the attacker, giving them full control of the appliance. Two other attack chains start from a predictable appliance passcode that lets an anonymous attacker inject malicious patch metadata. When an administrator opens the patch details, a stored cross-site scripting (XSS) payload runs in their browser and invokes a command-execution interface as the nable user. The administrator’s session can also be hijacked through the same flaw to submit a crafted audit-export configuration that runs commands as root. A fourth chain writes an executable web page into the server’s web directory through a directory traversal flaw in a software repository feature, then escalates to root through a passwordless installer that executes a configuration from a directory the nable user can write to. Bales tested all of the exploits against N-central Appliance 2026.4.0.31, a pre-release build, and noted in the repository’s documentation that most, if not all, of the flaws should work on previous versions, including the most up-to-date release. N-able has not confirmed how many of the 33 flaws it could reproduce, but t…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.