# N-able pulls its N-central remote management cloud offline after 33 unpatched bugs go public

> A researcher published working exploits for the IT management tool. N-able took its hosted service down and told customers to take their own servers offline too.

- Published: 2026-11-10T16:56:00.000Z
- By: The Circuit Staff
- Type: News
- Topics: Security
- URL: https://thecircuit.ca/posts/2026-11-10-n-able-n-central-offline-zero-days/

N-able has taken its cloud-hosted N-central service offline after a security researcher published dozens of unpatched vulnerabilities in it, [TechCrunch reports](https://techcrunch.com/2026/11/10/n-able-takes-its-remote-access-service-offline-after-researcher-publishes-dozens-of-zero-day-bugs/). N-central is remote monitoring and management software: IT service providers use it to manage and access their clients' computers and networks, which is what makes flaws in it so dangerous.

The researcher, Ben Bales, posted the bugs on GitHub on Sunday under the name "Able2Shell." [His write-up](https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able) lists 33 vulnerabilities, with proof-of-concept code, and says all of them were unpatched when he published. They include ways to read credentials, create administrator accounts and run code as root on the N-central appliance. Bales told Bleeping Computer he went public because N-able allegedly failed to patch flaws he had reported in a different product, per TechCrunch.

N-able said the hosted service is down "while we take the necessary actions to secure the environments and implement appropriate remediation," and urged customers running their own N-central servers to take them offline too. It says it has "no evidence of successful exploitation against any of its customer environments." It didn't tell TechCrunch whether it can check its logs to confirm that.

N-able is a U.S.-listed company headquartered in Burlington, Mass., and Ottawa is among its office locations, according to its [annual report](https://www.sec.gov/Archives/edgar/data/1834488/000183448826000046/nabl-20251231.htm).

**What's still unknown:** when a fix will ship, how long the hosted service will stay down, and whether any of the flaws had been reported to N-able before Sunday.

**Why it matters:** Tools like this have the keys to thousands of businesses at once, which is why attackers target them. If your company's IT is handled by an outside provider, ask whether it uses N-central and what it's doing while the service is down. N-able's [status page](https://uptime.n-able.com/event/202580/) is tracking the outage.