N-able N-central: 33 flaws with public PoCs, incl. unauthenticated XXE-to-RCE; no fix yet
Severity: critical · Patch status: unpatched · Since 2026-11-09
On 8-9 November 2026 a researcher publishing from the GitHub account Oracle-Security posted proof-of-concept exploits for 33 flaws in N-able's N-central RMM, all tested on the pre-release appliance build 2026.4.0.31. BleepingComputer names the researcher as Sean Bales; that name is not confirmed beyond its reporting. The worst chain is an unauthenticated XXE in service import that resets an account's password, runs code as the nable user and can add an enabled Default Administrator. A separate stored-XSS chain reaches root through Audit Export once an administrator opens the poisoned patch record. The researcher says the flaws are unpatched, and that earlier reports of two other RCEs and a privilege-escalation bug in a different N-able product remain unpatched. N-able took its Hosted N-central environment offline as a precaution, reportedly across the Americas, Europe and Asia-Pacific, and advised on-premises customers to shut their servers down until further notice. It says it has not observed active exploitation, and that it is developing and validating a hotfix with no return date given. No CVE identifier appears in any source reviewed. Until a fix ships, keep N-central off exposed networks or offline; then apply the hotfix and look for unexpected Default Administrator accounts, password resets and commands run as nable.
What to do
- Immediately take on-premises N-central servers offline per N-able guidance until a hotfix is released
- Monitor N-able status updates (published every ~4 hours) and apply the hotfix as soon as it is available
- Audit N-central instances for unexpected 'Default Administrator' accounts, password resets, and commands run as the nable user
- Restrict network exposure of N-central interfaces and review logs for XXE/service-import activity
- Assume MSP-managed downstream customer environments may be at risk and verify no unauthorized access via N-central
Sources
All live incidents on Threat Watch
