N-able takes hosted N-central offline and tells on-prem customers to shut servers down after a researcher published more than 30 alleged zero-days

N-able took its hosted N-central platform offline on Nov. 9 and told on-prem customers to shut their servers down after a researcher published exploits for what he says are more than 30 zero-days.

One N-central server can run scripts and open remote sessions on every endpoint it manages, so on-prem admins should keep their servers off and check them for signs of intrusion since Nov. 8 before bringing them back.

N-able said on its Uptime page that it is "temporarily taking" its hosted N-central environment offline as a precaution, and asked on-prem customers to take their servers offline "until further notice." As of 19:59 UTC on Nov. 9, N-able said it has "no evidence of active exploitation or unauthorized data access," is developing and validating a hotfix, and has no restoration estimate. It targets updates every four hours; none newer had appeared by 22:52 UTC on Nov. 9.

BleepingComputer reported that researcher Sean Bales published a repository of proof-of-concept exploits late on Nov. 8. Bales said he did not disclose the flaws to N-able first, because "they don't take disclosure seriously"; N-able did not answer BleepingComputer's questions about his earlier reports. Bales said he tested against N-central 2026.4.0.31, a pre-release build, believes earlier versions are also affected, and says the discovery was AI-assisted. N-able has not confirmed a count or versions, and BleepingComputer said it has not verified all of them.

By Bales's account, the worst chain starts with an unauthenticated XXE flaw, steals a session, resets a password, runs commands as the nable user and can create an enabled "Default Administrator" account. Huntress counts 33 vulnerabilities from the researcher's disclosure, three chains reaching remote code execution and one reaching root.

Who is affected by the N-central shutdown?

On-prem N-central customers, hosted customers and clients of MSPs that manage endpoints with N-central are all affected. N-able's page lists hosted and on-prem services in the Americas, Europe and Asia-Pacific.

What should on-prem admins do now?

Our recommendation, in order:

1. On-prem admins, now: power the server down or block all its inbound and outbound internet traffic. Record the time.
2. On-prem admins, this week and before any restore: preserve the server's logs, then review console login and authentication activity since Nov. 8, plus new or changed administrator accounts (including an enabled "Default Administrator"), password resets, and remote sessions and newly deployed scripts on endpoints. Neither Bales's repository nor BleepingComputer's report says when he found the flaws, so go back further if your logs allow. Huntress says attackers in earlier N-central exploitations, such as the one in September, pushed unauthorized scripts and tools to downstream endpoints.
3. Customers of an MSP, today: ask in writing whether its N-central is hosted or on-prem, when it went offline, and whether it ran the step 2 checks.
4. IT, while the server is off: manage endpoints through N-able.app. N-able says Asset View, Patching, Vulnerability Management, scripting, policies and tagging stay online for hosted and on-prem partners using N-able Login, and lists TakeControl from Assets view as a preview. Add no new third-party remote tools.
5. On-prem admins, when N-able says so: restore on N-able's word, not a version string. Huntress notes N-able does not always change the version number for live hotfixes.

Why not wait for signs of exploitation

Because N-central servers have been exploited twice this year, and this time the exploit code is public. CISA added CVE-2026-18577, the incomplete patch for CVE-2026-18556, to its Known Exploited Vulnerabilities list on Aug. 3. In September, N-able said a new pre-authentication flaw, CVE-2026-86218, had been exploited in the wild, and Huntress investigated a compromise of a fully patched customer server, though it could not say which flaw the attacker used. Public code shortens the time to the next attempt, so we read "no exploitation seen" as true for Nov. 9 only.