Affected Systems
N-able N-central RMM platform: all on-premises builds below version 2026.3.1.14, including servers patched with Hotfix 3 (2026.3.1.13) released hours earlier. Hosted N-central (NCOD) instances already patched by vendor. Does not require agent upgrades.
Exploitation Status
Conflicting vendor statements: N-able incident notice states the vulnerability "has been observed being exploited in the wild" per independent security researcher; release notes say exploitation is "unconfirmed." Huntress reproduced PoC exploit chain but could not confirm this specific CVE was used in a September 4 compromise due to log rotation. No attribution, IOCs, or detection guidance published.
Business Impact
Unauthenticated remote code execution on N-central servers (CVSS 4.0: 10.0 Critical). Attackers gain full server compromise without credentials. N-central is widely deployed RMM platform with access to managed endpoints across customer environments—compromise enables lateral movement to all managed devices. This is the fourth hotfix in five weeks; previous August flaws (CVE-2026-18577) were exploited to deploy Cloudflare tunnels for persistent access. MSPs and enterprises using on-premises N-central face immediate risk of full environment compromise.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade all on-premises N-central servers to version 2026.3.1.14 (Hotfix 4) immediately via direct upgrade paths from 2025.4, 2026.1, 2026.2, 2026.3, or 2026.3.1.x
- Restrict inbound access to N-central console using IP allowlisting or VPN; consider taking internet-facing servers offline until patched
- Audit all N-central user accounts for unexpected or unauthorized accounts that may indicate prior compromise
- Review N-central server logs and Take Control feature usage for anomalous administrative activity or endpoint access between August 2 and patch deployment
- Monitor managed endpoints for unauthorized Cloudflare tunnel services or similar persistence mechanisms consistent with prior N-central attack patterns