N-able N-central: Exploited Auth Bypass and Pre-Auth RCE
Any self-hosted N-central server below 2026.3.1.14 should be treated as exposed and patched today, and any server that was patched late needs a compromise review, because one stolen RMM console reaches every managed endpoint.
Must act: MSPs and IT teams running on-premises (self-hosted) N-central, above all where the console is reachable from the internet or was patched more than a few days after each hotfix.
Can relax: Hosted N-central (NCOD) customers, whose servers N-able patched itself, still need to audit users and Take Control activity but have no upgrade to run.
- Check the N-central server build and upgrade any on-premises server below 2026.3.1.14 to 2026.3 Hotfix 4 now; servers older than 2025.4 need an intermediate upgrade first.
- Take the N-central console off the open internet: allowlist admin IPs or require VPN, enforce MFA on every account, and front it with SSO where possible.
- Audit N-central users for accounts you did not create (especially .invalid or lookalike email addresses), unexplained password resets and role changes.