Hackers Exploit New N-central Zero-Day Hours After PoC Publication

Threat actors exploited a critical zero-day vulnerability in N-able N-central almost immediately after a proof-of-concept was published, underscoring how razor-thin the window between disclosure and active exploitation has become. The flaw chained an Apache Axis vulnerability with a weakness in N-central's Legacy API to allow unauthenticated remote code execution with root privileges — a highly dangerous combination requiring no credentials whatsoever. Attackers wasted no time deploying XMRig cryptomining malware on compromised servers, demonstrating that even management platforms used by MSPs are high-value targets. This incident highlights the critical need for emergency patching procedures and proactive exposure reduction for internet-facing management infrastructure, especially when Legacy API components remain enabled unnecessarily.