New Security Update on N-central

N-able continues to make progress toward the safe restoration of services and affected functionality. Our investigation into the recent N-central vulnerabilities remains a top priority, and we continue to adjust security protections based on our monitoring and the evolving threat landscape.

As part of today’s investigation, we identified Indicators of Compromise (IOCs) relevant only to customers who have not disabled the Legacy API. Customers can use the indicators below as part of their assessment and monitoring efforts.

Indicators of Compromise (IOC List)

Incoming URLs

• hxxp://157.20.241[.]16:8080/jup.sh
• hxxp://157.20.241[.]16:8080/xvgz
• hxxp://157.20.241[.]16:8080/xmrig.tgz
• hxxp://157.20.241[.]16:8080/ob/cronhit?h=jup_start_<rig>&persist=<method>
• hxxp://157.20.241[.]16:8080/ob/fcheck

Outbound Traffic

• 157.20.241[.]16 (ports 8080, 19202 to 19418)
• 139.99.69[.]109:10128
• 79.76.51[.]56:39100

Our security assessment and remediation efforts are ongoing, with the protection of our customers and their environments as our highest priority.

Current Product Actions

• N-central Hosted customers
  • N-able has applied these temporary protections directly to Hosted environments. No server-side action is required from Hosted customers.
  • Legacy API is turned off by default in the product.
  • Intune integration has been turned off while additional protections are implemented and validated. This is a precautionary step.
  • Hosted customers should continue to follow our previous guidance to upgrade Agents and Probes.
• N-central On-Premises customers
  • Ensure Legacy API access is disabled in your environment.
  • Legacy API access is disabled by default.
  • If you enabled it, follow these instructions: How to Disable Legacy API settings on On-Premises N-central servers
  • As a precaution, if you are running the Intune integration, we have temporarily deactivated it for you. If we were unable to execute this, our support team will contact you directly by phone. This is a precautionary step.
  • On-Premises customers should also continue to follow the previously communicated HF2 guidance, including upgrading their Agents and Probes.

Setting the record straight

Claims that N-able ignored responsible disclosure from the researcher are inaccurate. The new vulnerabilities that the researcher published on November 9 and November 12 were not responsibly disclosed through our established reporting channels. We maintain several reporting channels including an active bug bounty program specifically to enable security researchers to report potential vulnerabilities responsibly, and we work with researchers who use that process to investigate and address their findings.

What happens next

Our teams are actively assessing the new disclosures, developing additional remediation, and working to safely restore affected functionality. Protecting our partners and their customers remains our highest priority, and we will continue to take precautionary action where necessary.

We are continuing to monitor closely and will provide updates as needed.

For more information:

• Support: https://me.n-able.com/s/
• Uptime: https://uptime.n-able.com/