Hackers Exploit N‑central Flaws to Infect 21 Managed Servers, Including 19 Running Hotfix 2
Threat actors leveraged two critical RMM vulnerabilities (4EverAble2Shell, Agent2Shell) to gain shell access on 21 servers managed through N‑central, despite most running the latest hotfix. The breach highlights the need for continuous third‑party risk monitoring and rapid patch validation.
ADTP Breach Watch· November 13, 2026· The Hacker News
SeverityHigh
Type☁️ Breach
ConfidenceHigh
ReportedNov 13, 2026
Technology & SaaSManaged‑service‑providers (MSPs) and their enterprise customers across finance, healthcare, and technology sectors.Vulnerability ExploitOther
What happened
Attackers used unauthenticated RCE bugs in N‑central’s web console and agent module to install a backdoor on 21 managed servers; 19 of those servers had Hotfix 2 applied.
Why it matters for trust and compliance
The incident tests the control objective of vendor/third‑party risk management and continuous monitoring, a single VCF control that supports audit readiness across multiple frameworks.
Demonstrates the necessity of continuous monitoring of third‑party product patches and security advisories.
Provides evidence that robust vendor‑risk controls can be leveraged as audit‑ready artifacts for frameworks such as NIST CSF 2.0.
Who is affected
Managed‑service‑providers (MSPs) and their enterprise customers across finance, healthcare, and technology sectors.
Recommended actions
Inventory all assets running N‑central agents and verify hotfix levels.
Apply N‑able Hotfix 3 immediately; if unavailable, isolate affected agents and disable remote script execution.
Enable detailed logging of agent‑to‑server traffic and feed it into a centralized SIEM for anomaly detection.
Update third‑party risk policies to require real‑time monitoring of vendor security advisories.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.