#n-able
-
CISA Adds Critical N-able N-central RCE Vulnerability to Its Actively Exploited Catalog
The flaw, which carries the maximum CVSS score of 10.0, allows unauthenticated code execution and is already being used in attacks. U.S. federal agencies have been ordered to remediate it by September 11, 2026.
-
N-able rushes out a fix for a critical RCE flaw in N-central
N-able has released an emergency update for its N-central remote monitoring platform, patching a maximum-severity vulnerability that allows arbitrary code execution without authentication.
-
Storm-1175 Switches to a New Ransomware Strain, StormEncryptor
Microsoft reports that the China-linked group Storm-1175 has abandoned Medusa in favor of a previously undocumented ransomware, StormEncryptor, breaking into networks through a fresh vulnerability in N-able N-central.
-
N-able Releases Hotfix 2 for N-central Amid Active Attacks on Managed Systems
Attackers are exploiting an authentication-bypass flaw in the N-central RMM platform to gain administrative access and maintain persistence through Cloudflare tunnels. The company has released a mandatory patch that supplements the previous one.
-
N-central Breach: The First Patch Didn't Close the Hole, Attackers Took Over MSP Servers
N-able reported that attackers exploited an authentication bypass in the N-central platform, gained administrative access to servers, and reached the client systems managed through them. The first fix turned out to be incomplete.