Bug Bounty

N-able zero-day dump: researcher says earlier bug reports went unpaid

A researcher published 30+ N-central zero-days without notice, citing unpatched, unpaid earlier reports. What it means for UK MSPs and disclosure.

Illustration of a software bug over a network diagram representing the N-able N-central zero-day disclosure

A researcher has published proof-of-concept exploits for more than 30 alleged zero-days in N-able’s N-central without warning the vendor, saying earlier reports he made to the company went unpatched and unpaid. N-able has taken its hosted platform offline and told on-premises customers to switch their servers off.

What happened

Late on Sunday 8 November, a GitHub repository called Able2Shell appeared containing write-ups, screenshots and working proof-of-concept code for what the author describes as more than 30 zero-day vulnerabilities in N-central, the remote monitoring and management (RMM) platform N-able sells to managed service providers (MSPs) and internal IT teams. Huntress, which is tracking the incident, counts 33 flaws that can be combined into four distinct exploit chains.

Reporting differs on who is behind the release. BleepingComputer and Bank Information Security name the researcher as Sean Bales, an application security consultant who, according to the latter, announced the repository on LinkedIn. TechTarget reports that the repository sits under a GitHub account called “Oracle-Security”, owned by someone using the handle BinaryNinja. Whether these are the same person has not been confirmed, so claims here are attributed to the outlet that reported them.

N-able opened an incident on its status page at 15:15 UTC on Monday 9 November, rated it a major outage and took hosted N-central offline in the Americas, Europe and Asia-Pacific. It also urged customers running their own N-central servers to take them offline until told otherwise. In its security alert, quoted by TechTarget, the company described the release as a “non-responsible communication of critical vulnerabilities”. It says it has seen no active exploitation and no evidence of unauthorised data access, and is building a hotfix. GBHackers reported an estimated release around midday US Eastern time on 10 November; at the time of writing that had not been confirmed.

The detail

The more interesting part of this story, from a disclosure point of view, is why the code went public without notice. Speaking to BleepingComputer, Bales said the decision was deliberate. He says that roughly five to six months ago he reported two remote code execution flaws and a privilege escalation bug in a different N-able product, that those issues are still unfixed, that chasers sent in the past four to six weeks drew no reply, and that the bounty platform paid him nothing for the work. In his words, the company does not “take disclosure seriously”. He stresses that none of the newly published N-central flaws were ever reported to N-able.

N-able did not answer BleepingComputer’s questions about those earlier reports, their patch status or the unanswered emails. Bales says the company’s chief executive and chief technology officer contacted him after the release to ask him to take the repository down and work with them, and that he was not threatened. Those claims about the earlier reports come from the researcher alone and have not been verified independently.

On the technical side, the flaws reportedly cover authentication bypass, credential disclosure, file write and path traversal issues, cross-site scripting and injection bugs. Huntress says three of the chains end in remote code execution and one in privilege escalation to root. The researcher says he tested against a pre-release build (Appliance 2026.4.0.31) and believes older releases are also exposed. He also told the outlet that AI tools helped him find the bugs.

The product has had a difficult year. Huntress lists five critical N-central CVEs this year, including CVE-2026-18556, the incomplete fix tracked as CVE-2026-18577, and CVE-2026-86218, an actively exploited pre-authentication flaw. Bank Information Security notes that the coming hotfix would be N-able’s fifth emergency fix since 1 August.

Timeline of the N-able N-central disclosure dispute from the researcher's earlier reports to the platform shutdown on 9 November 2026

Why it matters for UK organisations

N-central is used by MSPs in the UK as elsewhere, and RMM servers are about as valuable a target as an attacker can find. One compromised console can push scripts and remote access tools to every client estate it manages. Huntress points out that in earlier N-central intrusions, attackers sprayed unauthorised scripts and tools into downstream environments.

The disclosure dispute matters here too. The Department for Science, Innovation and Technology’s voluntary Software Security Code of Practice, drawn up with the NCSC, asks vendors to run and publish an effective vulnerability disclosure process and to give customers timely updates. The NCSC’s own disclosure toolkit puts the first rule bluntly: “Don’t ignore the report.” Whatever happened with Bales’s earlier reports, UK buyers should be asking their software suppliers how they handle researcher reports, how quickly they fix the results, and whether that is written into contracts.

Expert view

In my experience, dropping full exploits without notice almost always hurts the end customers more than the vendor. MSPs and their clients now face a window in which working code is public and no patch exists. Previdian’s Ryan Dewhurst told TechTarget the firm’s honeypots had seen no exploitation attempts yet, but he expects that to change quickly; weaponising it would take at least a few hours. Pulling the platform offline was the right call, though an expensive one.

That said, the grievance is a familiar one. When we report findings to vendors, the pattern Bales describes is not unusual: a report goes in, months of silence follow, and nothing arrives through the bounty platform. Coordinated disclosure relies on both sides keeping the deal. The usual 90-day window, which Bank Information Security notes is itself a compromise, only works if vendors fix things and keep reporters informed. As Inversion6’s Ian Thornton-Trump put it to ISMG, “It’s the new AI world called ‘drop the PoCs'”. Vendors whose disclosure process cannot cope with AI-assisted report volumes should expect more protests like this one, and their customers will bear the cost.

A bounty programme only builds trust if it pays out and fixes things; if researchers think reports vanish into a queue, some will go public instead.

What to do now

  1. Shut down on-premises N-central and leave it down until the vendor gives the all-clear. Watch N-able’s status page, which it says it is updating every four hours.
  2. Review N-central logins and authentication activity from 8 November onwards, as Huntress advises. Look for new administrator accounts, unexpected remote control sessions, new services and scripts pushed to endpoints (Cyber Essentials: user access control).
  3. If you rely on an MSP, ask them directly whether they use N-central, what they have shut down and how they are hunting for misuse in your environment.
  4. Apply the hotfix as soon as it ships and check the build number afterwards, as N-able does not always change version numbers for live hotfixes (Cyber Essentials: security update management).
  5. Restrict exposure of RMM consoles to known networks or behind a VPN with MFA, rather than leaving them open to the internet (Cyber Essentials: firewalls, secure configuration).
  6. Review your own disclosure process. Publish a security.txt and a clear policy, acknowledge reports promptly and keep reporters updated, as the NCSC toolkit recommends.

Bottom line

This is both an urgent patching problem for every MSP running N-central and a warning about what happens when trust in coordinated disclosure breaks down. Treat the RMM server as a crown jewel, push your suppliers on how they handle vulnerability reports, and remember that a vendor’s disclosure track record is now a supply chain risk in its own right.

Sources

Related Posts