← Back to the board
Issue file · activeTracking since Nov 9 · 12 articles · 8 outlets
N-able N-central zero-days exploited after researcher publishes exploit code
Tracking: N-able N-central zero-day disclosures and customer shutdownPolicy matter covering the public disclosure of more than 30 alleged zero-day vulnerabilities in N-able's N-central RMM platform, the vendor's decision to take hosted environments offline and instruct on-premises customers to shut down servers pending a hotfix, and related questions of coordinated vulnerability disclosure, exploit publication, and remote monitoring and management software security.
Cyber
Articles · 14 days
- Earliest seen
- Nov 9
- BleepingComputer · Monday, Nov 9
- Articles · 30d
- 12
- 2.0 per story
- Outlets
- 8
- Most: N-able (3)
- Hill · 30d
- 0
- None in 30 days or ahead
- Contracts · 30d
- 0
- No awards or solicitations
- Momentum
- 1.2
- Articles ▲12 vs prior week
Activity
30 days back, 14 ahead · hollow = scheduledWhat's happening
Updated yesterdayAfter a researcher published more than 30 alleged zero-days in N-able's N-central RMM platform, N-able took hosted servers offline, shipped hotfix 2026.4 HF2 and brought hosted systems back online. Attackers are exploiting the public 4EverAble2Shell flaw to deploy Monero miners, with reports of at least 21 compromised servers, most on HF2. N-able says a further HF3 will address remaining authenticated and agent impersonation flaws, and a separate ScreenConnect RMM+ intrusion adds to scrutiny of RMM security.
Latest
YesterdayOur first signal
Hill
No policymaker activity in the window.
Contracts
No procurement or funding activity in the window.
Pressure
16 articlesResearcher Sean Bales faults N-able's disclosure handling while N-able disputes that account; Huntback and WatchTowr highlight ongoing exploitation of patched and unpatched servers.
Who covered it, when
A dot per article · ringed = earliest in our sourcesForces at work
share of articles- Threats & findings12 · 75%In a related RMM incident, an RMM+ extension flaw let an intruder push malicious ScreenConnect clients to at least 288 computers across 48 organizations; ConnectWise disabled five extensions.ConnectWise · Huntress
- Technical milestones4 · 25%N-able released N-central 2026.4 HF2, restored hosted servers, and deferred remaining authenticated and agent impersonation fixes to a forthcoming HF3.N-able
In the news
12 articlesYesterdayN-ableN-able Vulnerability Remediation Update 2d agoN-ableOriginalNew Security Update on N-central 2d agoSecurityWeekEarliestOriginalHackers Exploit New N-central Zero-Day Hours After PoC Publication 3d agoBleepingComputerNew N-able "4EverAble2Shell" zero-day exploited hours after PoC released 3d agoHuntbackOriginal4EverAble2Shell is already mining Monero on live N-central servers 3d agoN-ableEarliestUpdate on N-central 2026.4 HF2 and ongoing security response 4d agoDark ReadingN-able Takes N-central Platform Offline After Discovery of 33 Flaws 4d agoCybersecurity DiveEarliestN-able issues hotfix after researcher dumps PoCs in disclosure spat 4d agoBleepingComputerOriginalN-able releases security hotfixes for zero-day vulnerabilities 4d agoCSO OnlineN-able N-central gets emergency fix two days after 33 exploits published 5d agoTechCrunchN-able takes its remote access service offline after researcher publishes dozens of zero-day bugs 5d agoBleepingComputerEarliestOriginalN-able takes cloud platform offline after 30+ "zero-days" published