Remote access company N-able took its cloud-hosted N-Central service offline in November 2026 after a security researcher publicly released dozens of vulnerabilities in the product, giving the company no advance notice to fix them before publication.
N-able confirmed in a status update on its website that its hosted N-Central offering is offline “while we take the necessary actions to secure the environments and implement appropriate remediation.” The company also urged customers running self-hosted deployments of N-Central to take down their own servers, citing fears that attackers could use the publicly disclosed exploits to gain access to customer networks.
Security researcher Ben Bales released the vulnerabilities — which he dubbed “Able2Shell” — on GitHub on Sunday. In a post on X, Bales described the bugs as a mix of flaws capable of stealing credentials, creating new administrative accounts, and gaining root access to affected N-able systems. Bales told Bleeping Computer that he chose to release the vulnerabilities publicly because N-able had allegedly failed to patch flaws he had previously reported in a different product.
N-Central is used by corporate customers to remotely access and manage devices and systems on their networks. During the outage, customers are unable to use the service. N-able said it has found no evidence of successful exploitation against any of its customer environments, though a company spokesperson did not respond to questions about whether server logs or other tools exist to verify that claim.
Remote access technologies are a frequent target of hackers, as these systems can provide broad access to a company’s internal network and data. The incident highlights the risks that uncoordinated public vulnerability disclosures can pose to enterprise software providers and their customers.
Source: TechCrunch