N-able N-central taken offline following public zero-day disclosures

# N-able N-central taken offline following public zero-day disclosures

https://gcdradar.vercel.app/incidents/n-able-n-central-taken-offline-following-public-zero-day-dis · AIR-2026-1844 · live

- Lane: Research
- Severity: 1 (Research / proof of concept): Demonstrated by researchers with no known patch yet.
- Fix status: Fix status unknown
- First reported: 2026-11-09
- AI role: No AI role
- Products: N-central

## Summary

N-able took hosted N-central environments offline after a researcher published over thirty alleged zero-day flaws. The vendor also advised on-premises customers to shut down their servers.

## What to do

Disable the Legacy API or restrict its exposure to the public internet on on-premise N-central servers.

## Latest updates

- 2026-11-13: Researchers name the remote code execution flaw 4EverAble2Shell. (https://securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication)
- 2026-11-13: Vendor restricts certain features and integrations as exploitation affects at least 21 servers, including systems running Hotfix 2. (https://thehackernews.com/2026/11/hackers-exploit-n-central-flaws-to.html)
- 2026-11-12: Active exploitation is reported deploying cryptocurrency miners on multiple servers including latest updates (https://bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released)
- 2026-11-12: Vendor investigates reports of new flaws affecting patched on-premise servers when the Legacy API is exposed to the internet. (https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html)
- 2026-11-12: Exploitation of the disclosed zero-day vulnerabilities has been observed in the wild. (https://securityweek.com/hackers-target-n-central-zero-days-as-n-able-rushes-patches)

## Sources

- 2026-11-09 BleepingComputer: N-able takes cloud platform offline after 30+ "zero-days" published https://bleepingcomputer.com/news/security/n-able-takes-cloud-platform-offline-after-30-plus-zero-days-published
- 2026-11-10 The Hacker News: N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html
- 2026-11-10 SecurityWeek: N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days https://securityweek.com/n-able-takes-n-central-offline-as-researcher-drops-over-30-zero-days
- 2026-11-11 BleepingComputer: N-able releases security hotfixes for zero-day vulnerabilities https://bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities
- 2026-11-11 Dark Reading: N-able Takes N-central Platform Offline After Discovery of 33 Flaws https://darkreading.com/endpoint-security/n-able-n-central-offline-33-flaws
- 2026-11-12 SecurityWeek: Hackers Target N-central Zero-Days as N-able Rushes Patches https://securityweek.com/hackers-target-n-central-zero-days-as-n-able-rushes-patches
- 2026-11-12 The Hacker News: New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html
- 2026-11-12 BleepingComputer: New N-able "4EverAble2Shell" zero-day exploited hours after PoC released https://bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released
- 2026-11-13 The Hacker News: Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 https://thehackernews.com/2026/11/hackers-exploit-n-central-flaws-to.html
- 2026-11-13 SecurityWeek: Hackers Exploit New N-central Zero-Day Hours After PoC Publication https://securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.