N-able Takes N-central Offline: What to Ask Your MSP Today

N-able has taken its hosted N-central servers offline and is telling customers who run N-central on their own servers to take them offline too. N-able’s status page says it is responding to "the public disclosure of critical vulnerabilities in N-central by an independent security researcher." It says it sees scanning tied to published proof-of-concept code, but no evidence so far that any customer was exploited.

N-central is a remote monitoring and management (RMM) tool. Managed service providers (MSPs) use it to patch, monitor and remote into the computers they look after. Many nonprofits, associations and small agencies never log in to N-central themselves, but their MSP does, every day. This post covers what N-able has said, what still works, and the questions to ask your MSP today. Facts are as of 9:00 a.m. ET on November 10, 2026.

The short version: if your MSP uses N-central, ask whether its server is offline right now, and how it will patch and support your machines until N-able’s fix ships. After the fix, ask for a compromise check, not only an upgrade. This is N-central’s third security emergency since August, so it is also a fair time to ask how your MSP protects the tool that controls all of your computers.

What N-able says about N-central

N-able posted a consolidated incident on its uptime status page, titled "N-central Critical Security Incident." The incident started at 14:00 UTC on November 9, 2026. N-able rates it a "Major Outage." Its status is "Investigating."

Here is what the post says, as of its 14:00 UTC update on November 10:

• An independent researcher publicly disclosed critical vulnerabilities in N-central.
• N-able sees "scanning activity associated with the published proof-of-concept code."
• N-able says: "At this time, we have no evidence that any customer environment has been successfully exploited."
• N-able is building and testing a hotfix. It gave an estimate of "Mid-day on November 10 (EST)."
• N-able took its hosted N-central environments offline "as a precautionary measure."
• N-able "strongly advises" on-premises customers to take their servers offline and keep them offline until N-able says they can come back.

N-able also writes: "We continue to recommend that N-central remain offline until the hotfix is available and your server has been successfully upgraded."

N-able has not published the number of flaws, CVE IDs or technical details on its own pages. Its status post says it will share updates and remediation steps there.

What still works while N-central is offline

N-able says customers cannot reach hosted N-central "classic" environments right now. Some related services may also be down.

Other tools stay online. According to the status post, N-able’s Ecoverse services remain available through N-able Login. They include Asset View, Patching, Vulnerability Management, scripting, policies and tagging. N-able says this applies to hosted and on-premises partners who use N-able Login.

N-able also lists preview features for this period. They include remote sessions through Take Control from Asset View and on-demand Windows patching.

So your MSP may still be able to patch and support your machines. It depends on whether it set up N-able Login and those newer services. Ask.

Why an RMM outage matters to a nonprofit

N-able describes N-central as unified endpoint management "with advanced RMM capabilities," built for MSPs and IT teams. In practice, an RMM server holds a trusted connection to every computer it manages. It can push software, run scripts and open remote sessions.

That is why attackers want RMM tools. One compromised server can reach every client of an MSP at once. It is also why N-able chose to shut the hosted service down, even with no confirmed customer exploitation.

For a small organization, the short-term effects are practical. Patch jobs may pause. Help desk staff may lose their usual remote control tool. Alerts from monitoring may stop. None of that is a breach. It does mean your MSP is working with fewer tools this week.

Our post on the GlobalProtect vulnerability shows the same pattern with a different product. Tools that sit at the edge of your network, or above all your machines, get attacked first.

The third N-central security event of 2026

This is not the first N-central emergency this year.

In August, N-able’s N-central security update described a threat actor "actively exploiting a previously unknown vulnerability in N-central," spotted on July 31. N-able said "a limited number of customers" were affected. It said attackers used Take Control to reach managed devices. It also warned that the hotfix "does not remove a threat actor who may already be present in your environment."

In September, N-able’s 2026.3 HF4 post covered three more CVEs. One, CVE-2026-86218, was a zero-day N-able said had "been exploited in the wild." N-able later wrote that it had "observed a handful of successful exploits against N-central customers" for two related flaws.

Separately, on November 3, N-able’s status page announced N-central 2026.4 HF1 for on-premises servers. It fixes three Linux CVEs in the AlmaLinux system N-central runs on. If your MSP’s server missed that update, it has more to catch up on.

Questions to ask your MSP about N-central today

These are our suggested questions. They are short on purpose. A good MSP will answer them in one email.

1. Do you use N-central for us? Some MSPs use N-able’s other tools, or another vendor entirely. Start here.

2. Hosted or on-premises? If hosted, N-able took it offline. If on-premises, did the MSP take it offline after N-able’s advice, and when?

3. Was the server reachable from the internet? An exposed server during the scanning N-able describes carries more risk than one behind a VPN.

4. How will you patch and support us this week? Ask whether they use N-able Login services or another tool in the meantime.

5. Will you check for compromise after the hotfix? N-able’s own August advice says a hotfix does not remove an attacker who is already in. Ask what they will look for, and on which machines.

6. Did you apply the August and September hotfixes on time? Ask for dates. Slow patching then raises the stakes now.

7. Who has admin access to N-central, and is it protected by MFA? N-able’s August post recommended MFA and turning off the in-product support account unless needed.

8. How will you tell us when it is back? Ask for a short note when the server is patched and back online.

If your MSP manages your firewall or VPN too, ask the same questions about those tools. Our explainer on multi-factor authentication covers the MFA basics for admin accounts.

What to do on your side

Most of the work sits with your MSP. A few steps are yours.

Tell staff that IT support may be slower this week, and why. Ask them to report any remote session they did not request. If a technician calls about a session, confirm it through your normal contact at the MSP.

Check your backups. If you rely on the MSP for backups, ask whether those run through N-central or a separate service. Our guide to data backup strategy covers the basics of keeping a copy the RMM cannot touch.

Keep an eye on management tools in general. Our post on the first MCP flaw in the KEV catalog is about a different product, but the lesson carries over. When an authentication check on a management tool fails, everything behind it is open.

What happens next for N-central

N-able released the hotfix, N-central 2026.4 HF2, on the evening of November 10. N-able upgrades hosted servers; on-premises servers need the upgrade as soon as possible, and Agents and Probes must be upgraded in both cases. Ask your MSP when its server was upgraded, when the Agents on your machines were updated, and what compromise check followed.

As of the morning of November 10, CISA’s Known Exploited Vulnerabilities catalog has no new N-central entry, and N-able has published no CVE IDs for these flaws. Both may change quickly. If CISA lists them, that confirms exploitation somewhere, and the compromise check moves from a good idea to a must.

Frequently Asked Questions