[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fj1aRFYk-UmmxW0P8aiKi9ziE6a2HlqJMsB_xOVR1TUk":3},{"article":4,"iocs":48,"watch_terms":71,"solutions":72,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"f9230a8f-0f0e-48c2-a6c6-e4e0d9300a2b","Hackers Target N-central Zero-Days as N-able Rushes Patches","hackers-target-n-central-zero-days-as-n-able-rushes-patches-a25f79","The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones. The post Hackers Target N-central Zero-Days as N-able Rushes Patches appeared first on SecurityWeek.","N-able is rushing patches for multiple zero-day vulnerabilities in its N-central product after a researcher disclosed over 30 flaws, some of which are being actively exploited. The company took hosted environments offline and urged customers to disconnect on-premises deployments while fixes were developed. Patches are available for unauthenticated vulnerabilities, with further fixes planned for authenticated ones.","N-able rushes patches for N-central zero-days after researcher drops 30+ flaws and attackers probe instances.","https:\u002F\u002Fwww.securityweek.com\u002Fhackers-target-n-central-zero-days-as-n-able-rushes-patches\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002FN-Able.jpeg","2026-11-12T09:39:55+00:00","2026-11-12T10:00:14.929326+00:00",8,[17,20,23],{"name":18,"type":19},"N-central","product",{"name":21,"type":22},"N-able","vendor",{"name":24,"type":19},"N-central 2026.4 HF2","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,56,59,62,65,68],{"type":50,"value":51,"context":52},"cve","CVE-2026-125883","XXE issues, CVSS score of 9.3",{"type":50,"value":54,"context":55},"CVE-2026-125878","XSS flaws, CVSS score of 8.7",{"type":50,"value":57,"context":58},"CVE-2026-125879","privilege escalation, CVSS score of 8.6",{"type":50,"value":60,"context":61},"CVE-2026-125880","XSS, CVSS score of 8.3",{"type":50,"value":63,"context":64},"CVE-2026-125881","SSRF, CVSS score of 9.3",{"type":50,"value":66,"context":67},"CVE-2026-91000","missing authentication, leading to privilege escalation, CVSS score of 8.4",{"type":50,"value":69,"context":70},"CVE-2026-125882","path traversal to remote code execution, CVSS score of 8.6",[21,18,24],{"controls":73,"vendors":161},[74,103,132],{"slug":75,"name":76,"problem":77,"products":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":104,"name":105,"problem":106,"products":107},"patch-management","Automated patch management","Known holes get closed in days, not months.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":133,"name":134,"problem":135,"products":136},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[137,145,153],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[],{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":172},"zero-day-surge-in-n-central-exposes-risks-of-delayed-vendor-patching","Zero-Day Surge in N-central Exposes Risks of Delayed Vendor Patching","A researcher disclosed over 30 vulnerabilities in N-able's N-central remote management platform, with some zero-days actively exploited before patches were available. Because N-central is widely used to manage IT infrastructure across many organizations, a single compromised instance can cascade into mass exploitation of downstream clients. The vendor's response — taking hosted environments offline and urging on-premises customers to disconnect — highlights how unpatched remote management tools are high-value targets. This incident underscores the critical importance of proactive vulnerability tracking, rapid patch deployment, and interim compensating controls when patches are unavailable.",[167,168,169,170,171],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-01: Incidents are contained","NIS2 Article 21(2)(e)","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning",{"NIS2 Article 21(2)(e)":173,"NIST SP 800-53 SI-2: Flaw Remediation":174,"NIST CSF 2.0 RS.MI-01: Incidents are contained":175,"CIS Control 7: Continuous Vulnerability Management (v8)":176,"NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning":177},"This point specifically covers vulnerability handling and disclosure in security acquisition, development, and maintenance, directly applicable to N-able's obligation to manage and rapidly remediate the disclosed zero-days in its product.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner, directly addressing the failure to patch N-central zero-days before active exploitation began.","This category covers containment actions during an incident, reflecting N-able's emergency response of taking hosted environments offline and urging customers to disconnect on-premises deployments to limit exploitation spread.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities in their software and systems, which would have ensured faster detection and patching of the 30+ N-central flaws before active exploitation.","RA-5 requires organizations to monitor and scan for vulnerabilities in their systems, which would have prompted customer-side detection of unpatched N-central exposure and earlier compensating controls."]