N-able takes remote-management platform offline after researcher publishes dozens of unpatched bugs

N-able, a publicly traded maker of software that information-technology firms use to remotely manage other companies' computer networks, took its hosted N-central platform offline on Monday after a security researcher published more than 30 previously undisclosed vulnerabilities in the product, several of which could let an attacker seize administrative control of affected systems.

The company also told customers who run N-central on their own servers, rather than through N-able's cloud, to shut those systems down "until further notice." The disclosure and shutdown were first reported by BleepingComputer and confirmed separately by TechCrunch.

What happened

Late on Sunday, a researcher BleepingComputer identified as Sean Bales posted proof-of-concept code for the flaws to GitHub under a repository he called "Able2Shell." N-able said it had received no advance warning of the disclosure. By Monday the company had confirmed the issues and pulled its hosted N-central environments offline across the Americas, Europe and Asia-Pacific.

In a status update, N-able said it was acting "while we take the necessary actions to secure the environments and implement appropriate remediation." A separate company statement described the episode as a case of "non-responsible communication of critical vulnerabilities" and said N-able "has not observed active exploitation of these vulnerabilities" or any unauthorized access to customer data.

The vulnerabilities

The researcher's disclosure covered a range of flaw types: authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity (XXE) injection, remote code execution and privilege escalation.

The most serious chain, according to the published material, is an unauthenticated XXE flaw in N-central's service-import function. Exploited together with other bugs, it could let an attacker hijack a trusted administrative session, reset an account password, run commands as the system's "nable" user and create a new, fully privileged administrator account with credentials of the attacker's choosing. A separate stored cross-site-scripting bug could execute commands as root when an administrator viewed maliciously crafted patch metadata. N-able has not assigned CVE identifiers to the newly disclosed flaws, and BleepingComputer noted it had not independently verified every one of the more than 30 issues claimed.

Why it matters, and who is affected

N-central is not consumer software. It is a remote monitoring and management platform sold to managed service providers — IT firms that run the networks, endpoints and backups of other, typically smaller, businesses on contract. A single compromised N-central instance can, in principle, give an attacker a foothold into every downstream client network that provider manages, which is why remote-management tools have become a recurring target for ransomware crews over the past several years.

N-able is a sizable player in that market. In third-quarter results filed with the Securities and Exchange Commission on November 5, the company reported revenue of $137.5 million, up 4.9% from a year earlier, and said its broader platform protects "over 500,000 businesses worldwide." N-able, trading on the New York Stock Exchange under the ticker NABL, did not break out a separate figure for N-central users in that filing. Customers directly affected fall into two groups: those using N-able's hosted version of N-central, which was offline, and those running the software themselves, who were told to power it down voluntarily.

A pattern of disclosures

This is not N-able's first brush with N-central security problems this year. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog added an N-central authentication-bypass flaw in August after attackers used it to compromise domain-administrator accounts at a customer site. N-able documented the episode on its own site, including an August security update describing the response: the company's Adlumin detection unit flagged unusual activity on July 31, issued initial guidance and registered a CVE on August 1, shipped a first hotfix the next day, and released a second hotfix on August 6 after finding a related attack path. N-able, which was spun off from SolarWinds as an independent, separately traded company in 2021, has said only a limited number of customers were affected by that earlier incident.

The researcher behind this week's disclosure gave his own account of why he skipped private notification this time. He told BleepingComputer he had reported flaws in a different, unnamed N-able product roughly five to six months earlier, had sent follow-up emails for four to six weeks without a response, and had received no payment under any bug-bounty arrangement. He said the company "don't take disclosure seriously." N-able did not respond to a question about those earlier reports. After the GitHub posting went up, the company's chief executive and chief technology officer contacted the researcher directly and asked him to take down the repository and work with N-able instead; the researcher said he was not threatened.

What's next

N-able said late Monday it was developing and validating a hotfix for the disclosed flaws but gave no estimate for when the hosted N-central service would be restored, saying only that it would post updates every four hours or sooner. Customers running on-premises installations have been told to keep those servers offline pending further guidance. Given the pattern of N-central vulnerabilities reaching CISA's exploited-vulnerabilities catalog earlier this year, security researchers are likely to watch closely for any sign that the newly disclosed bugs are being used in the wild before N-able completes its fix. The episode is also likely to renew scrutiny of how remote-management vendors handle outside vulnerability reports, an issue the researcher himself raised in explaining why he went public rather than filing a third private report.