New N-able N-central Zero-Day Exploits Target Patched Servers, Claiming Unauthenticated Root Access

Exploit code targeting N-able N-central emerged that bypasses the latest emergency hotfix, allowing unauthenticated attackers to gain root access and execute commands on managed Windows devices. This incident illustrates a critical gap in vulnerability management: patching alone cannot be treated as a complete remediation when active zero-day research is ongoing. The fact that fully patched servers remain exploitable means organizations must layer compensating controls—such as removing internet exposure—rather than relying solely on vendor hotfixes. Because N-central manages downstream Windows endpoints at scale, a single compromised server becomes a force-multiplier for attackers, making the blast radius exceptionally large. This underscores why internet-facing management platforms require especially aggressive network controls and continuous monitoring beyond the patch cycle.