N-able Technologies on Tuesday released an emergency hotfix to address zero-day vulnerabilities that were publicly disclosed earlier this week by an independent security researcher.
The company took its hosted N-central environment offline after researcher Sean Bales disclosed the flaws late Sunday. The platform is a widely used remote monitoring and management platform.
Bales posted what he said were 33 critical vulnerabilities, which he dubbed Able2Shell. The flaws, Bales said, could lead to anonymous credential theft, administrator creation and remote code execution, according to a post on Linkedin.
The researcher posted a detailed account of the findings on GitHub, including what he said was proof of concept.
N-able president and CEO John Pagliuca criticized the disclosure, saying it was done without proper coordination and had not been verified.
“Security research makes all of us stronger, and we value the partners who work alongside us to find and fix issues,” Pagliuca said in a statement. “But when the race to be first to spread unverified findings outweighs the duty to protect, it’s customers who carry the risk.”
The company disputed claims that it ignored attempts to responsibly disclose the vulnerabilities.
“Claims that N-able ignored responsible disclosure from the researcher are inaccurate,” the company told Cybersecurity Dive. “The new vulnerabilities that the researcher published on November 9 were not responsibly disclosed through our established reporting channels.”
After taking N-central offline, the company advised customers operating on-premises N-central servers to take them offline while it addressed the issues raised in the disclosure. Company officials said they had not seen any active exploitation of the vulnerabilities.
N-able on Monday said it was aware of scanning activity associated with the published PoC code.
The company on Tuesday released hotfix N-central 2026.4 HF2, which it said included a number of patches and updates designed to improve security.
Security researchers are closely monitoring the situation, and warn the newly issued hotfix may not be the end of the story.
“Everyone monitoring the Able2Shell situation will have noticed that N-Able has published an update with a hotfix addressing seven new CVEs,” Yordan Ganchev, principal threat intelligence specialist at watchTowr, told Cybersecurity Dive. “What they may also have noticed is that it won’t be the last hotfix they are expected to apply in what may feel like a perpetual N-Able patching Groundhog Day.”
Researchers at watchTowr observed probing activity within 12 hours of the zero-day disclosures and later saw exploitation attempts that matched the PoCs.
The company has addressed a series of security flaws in recent months. In September, N-able released a patch to address a critical pre-authentication vulnerability tracked as CVE-2026-86218.
The company on Wednesday said all hosted servers had been successfully upgraded.
——————————————————-
Click Here For The Original Source.
