N-able took its hosted N-central environments offline on Monday after researcher Sean Bales publicly disclosed more than 30 alleged zero-day vulnerabilities, which he named Able2Shell.

The outage affects hosted and on-premises N-central services across the Americas, APAC and Europe, while certain Ecoverse services accessed through N-able Login remain operational.

The reported flaws include credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity injection and remote code execution; successful attacks could give an intruder administrative access and allow commands to run as root.

The most critical exploit chain reportedly uses an unauthenticated XML external entity flaw to steal a trusted session, reset an account password, create an attacker-controlled administrator account and run commands on the server as the nable user.

Bales described four exploit chains that could lead to remote code execution and released proof-of-concept code for every reported flaw; the vulnerabilities had not yet received CVE identifiers.

N-able said it was validating the vulnerabilities and preparing a hotfix, with rollout expected around midday November 10, and advised customers to keep on-premises N-central deployments offline until patches are released.

N-able said it had found no evidence of active exploitation or unauthorized data access and planned to provide updates every four hours or sooner.

Bales said he disclosed the N-central exploits without advance notice because N-able allegedly had not patched two remote code execution flaws and a privilege-escalation flaw he had reported in another product five to six months earlier, despite follow-up emails and no bug bounty payment.

Bales said N-able executives contacted him after the disclosure and asked him to remove the repository and work with the company; N-able did not answer BleepingComputer’s questions about his allegations concerning the earlier reports.