Hackers Exploit N‑central Flaws to Infect 21 Managed Servers, Including 19 Running Hotfix 2

Ce qui s’est passé

Attackers used unauthenticated RCE bugs in N‑central’s web console and agent module to install a backdoor on 21 managed servers; 19 of those servers had Hotfix 2 applied.

Pourquoi c’est important pour la confiance et la conformité

• The incident tests the control objective of vendor/third‑party risk management and continuous monitoring, a single VCF control that supports audit readiness across multiple frameworks.
• Demonstrates the necessity of continuous monitoring of third‑party product patches and security advisories.
• Provides evidence that robust vendor‑risk controls can be leveraged as audit‑ready artifacts for frameworks such as NIST CSF 2.0.

Who is affected

Recommended actions

1. Inventory all assets running N‑central agents and verify hotfix levels.
2. Apply N‑able Hotfix 3 immediately; if unavailable, isolate affected agents and disable remote script execution.
3. Enable detailed logging of agent‑to‑server traffic and feed it into a centralized SIEM for anomaly detection.
4. Update third‑party risk policies to require real‑time monitoring of vendor security advisories.