Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-197290786fEarly warningVulnerabilityReported, not confirmed

N-able takes N-central offline after researcher discloses 30+ alleged zero-days

N-able has taken its hosted N-central environments offline and told on-premises customers to shut down their servers.

Written by a model from the sources below. Verify against them.

Sources8Reported, not confirmed
Kind
Vulnerability
Vendor
N-able
Product
N-central
Status
Reported, not confirmed
First seen

Summary

N-able has taken its hosted N-central environments offline and told on-premises customers to shut down their servers. The action followed a security researcher's public disclosure of more than 30 alleged zero-day vulnerabilities, some with exploits that could let attackers take over affected systems.

What to do

  • Shut down on-premises N-central servers as N-able advises until a fix is available

  • Check N-able's security advisories for patch and status updates

  • Review N-central systems for signs of unauthorized access

Timeline

  1. Made public by r/netsec
  2. First seen by cve.now

Evidence 8

  1. Social
    r/netsec
    “N-able N-central Critical Vulnerabilities: What We Know So Far”
  2. Social
    Mastodon
    “Today I bring you Able2Shell, a repository with over 30 0-days I have discovered for N-Central N-able - All exploits were tested on their latest pre-release version.”
  3. Social
    Mastodon
    “Operators should take the platform down and hold until vendor patches are issued — do not attempt to resuscitate unilaterally.”
  4. Social
    Mastodon
    “N-able is responding to the public disclosure of multiple alleged critical vulnerabilities in its N-central remote monitoring and management platform.”
  5. Press
    BleepingComputer
    “N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that could let attackers take over vulnerable systems.”
Show all 8 sourcesShow fewer sources
  1. Social
    Bluesky
    “A major security incident has forced N-able to take its hosted N-central infrastructure offline worldwide and advise on-premises customers to shut…”
  2. Social
    Mastodon
    “A security researcher just dropped a bombshell, publishing over 30 alleged zero-day vulnerabilities in a public repository, prompting a swift response from N-able to shut down its hosted environments and warn customers to take precautions.”
  3. Social
    Mastodon
    “Details and a proof-of-concept exploit for 33 N-central vulnerabilities are public.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-197290786f

Has N-able confirmed it?

r/netsec, Mastodon and Mastodon report an attempted attack. None of the sources says the attackers got in. No statement from N-able has reached cve.now yet.Source: r/netsec, Mastodon, Mastodon, Mastodon, BleepingComputer, Bluesky, Mastodon, Mastodon

What should N-able users do?

Shut down on-premises N-central servers as N-able advises until a fix is available. Check N-able's security advisories for patch and status updates. Review N-central systems for signs of unauthorized access.

Sources