N-CENTRAL active exploitation, Mitigate immediately.

N-Central earlier today reported active exploitation and post exploitation actions of connections and persistence on managed RMM/client devices (cloudflare tunnels being installed on end user devices/servers) status page advisory includes hosted installs.

Take your installs offline immediately and threat hunt.

Earlier today n-central said servers on the latest release were safe but have updated the advisory to include the latest release and working on a new hotfix, keep an eye on https://uptime.n-able.com/

Current IOCs listed here, also affects hosted instances so monitor accordingly. Community information suggests that a strong IOC is if your server is suddenly showing as unlicensed.

https://www.n-able.com/blog/n-central-security-update-august-1-2026