N-able N-central flaws with public exploits let attackers run code on servers

A researcher published details and exploit code late on Nov 8 for flaws in N-able’s N-central remote monitoring and management server. Huntress counts 33 flaws and says they chain into at least four exploits that run code or gain root. N-able says it hasn’t seen attacks. It took hosted N-central offline on Nov 9, told on-premises customers to take their servers offline and expects a hotfix around midday Nov 10.

The flaws include credential disclosure, file writes, directory traversal and cross-site scripting, the researcher’s write-up shows. Some need no login. One chain starts with an anonymous request and ends in code running as the appliance’s nable user, plus a new administrator account. Others plant a script that runs when an administrator views patch details, or climb from the nable user to root.

The researcher tested N-central Appliance 2026.4.0.31, a pre-release. Most if not all of the flaws should also work on earlier versions, including the latest release, the researcher says. N-able calls the release of the details a “non-responsible communication” and hasn’t said which versions are affected. None of the sources gives CVE IDs for the flaws.

N-able opened a critical security incident at 10:15 a.m. ET on Nov 9. Its services under N-able Login, including patching, scripting and Asset View, stay online while hosted N-central is down. At midnight ET on Nov 10, N-able said the hotfix was on track and it had seen no sign that customer environments were affected.

Huntress notes that N-able doesn’t always change the version number for live hotfixes that need no reboot, so the fixed build may still read 2026.4.0.31. It also notes that N-able patched other N-central flaws in August and September, one of them exploited before a fix.