# N-able Responds to Zero-Day Exploits with Urgent Patches

*Published November 13, 2026*
*Source: [https://www.securityweek.com/hackers-target-n-central-zero-days-as-n-able-rushes-patches/](https://www.securityweek.com/hackers-target-n-central-zero-days-as-n-able-rushes-patches/)*

## Executive Summary

N-able swiftly patched critical zero-day vulnerabilities in its N-central product following public disclosure by a researcher. Urgent updates have been issued to mitigate active exploitation, with all users advised to apply the latest fixes immediately.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/n-able-responds-to-zero-day-exploits-with-urgent-patches) or [see plans](https://www.sec-news.ai/pricing).*

## Article

N-able has swiftly addressed several critical vulnerabilities in its N-central product after security researcher Sean Bales publicly disclosed over 30 zero-day exploits. These vulnerabilities, collectively referred to as Able2Shell, were released without prior notification to N-able due to dissatisfaction with the company's handling of previous reports. In response, N-able took immediate action by taking its hosted N-central environments offline to investigate and initiate fixes, urging customers to also secure their on-premises systems. The company has since restored its hosted services, having mitigated the most severe and exploitable vulnerabilities. Notably, vulnerabilities that could be exploited without authentication have been prioritized and patched. These include serious issues like XXE, XSS flaws, privilege escalation, SSRF, and missing authentication, with CVSS scores ranging up to 9.3. Additionally, a path traversal vulnerability leading to remote code execution, identified by Nate Fair of Sprocket Security, has also been resolved. N-central 2026.4 HF2 is the update containing these critical patches, and N-able emphasizes the urgency for all users to update immediately as attackers are actively scanning for exposed instances. Despite the release of proof-of-concept code, N-able reports no signs of compromise in its hosted servers. The company has clarified that the researcher bypassed its established channels for vulnerability reporting, reinforcing the importance of responsible disclosure to protect users effectively. N-able's president and CEO, John Pagliuca, highlighted the need for the cybersecurity community to prioritize customer protection through diligence and transparency in vulnerability management.