N-able has released a second hotfix for its N-central remote monitoring and management (RMM) platform, part of an ongoing response to active exploitation of a recently disclosed vulnerability in the product. The company said it is continuing to investigate incidents in which attackers have reached systems managed through N-central.

In a statement, N-able said it is “proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques,” and stressed that the new hotfix is not simply a reissue of its earlier fix but addresses additional attacker behavior observed since the initial patch.

Why This Matters

N-central is widely used by managed service providers (MSPs) to remotely monitor and administer client IT environments, making it an especially attractive target. A successful compromise of an RMM platform can give attackers a foothold across every endpoint an MSP manages, turning a single vulnerability into a supply-chain-style attack vector affecting many downstream organizations at once.

The fact that N-able is issuing follow-on hotfixes, rather than considering the matter closed after its first patch, indicates that threat actors are actively adapting their methods to work around initial mitigations and, in some cases, are succeeding in reaching and persisting on managed systems.

What Administrators Should Do

  • Apply the newly released hotfix to all on-premises N-central instances as soon as possible.
  • Review N-able’s advisories closely, since the vendor indicates this update addresses behavior beyond the original patch.
  • Audit N-central server and agent logs for signs of unauthorized access, unfamiliar administrative accounts, or unexpected configuration changes.
  • Treat any managed endpoints that were exposed prior to patching as potentially compromised and inspect them for persistence mechanisms.
  • Restrict and monitor network access to N-central management interfaces where possible.

N-able has not published full technical details of the underlying vulnerability or indicators of compromise in the material reviewed here. Organizations running N-central should monitor the vendor’s official advisories for further updates as the investigation continues.