N-able releases fourth N‑central hotfix in five weeks to seal unauthenticated RCE bug

N-able, a provider of remote monitoring and management software, issued its fourth emergency hotfix for the on‑premises N‑central platform within a five‑week span, targeting an unauthenticated remote‑code‑execution (RCE) vulnerability that its own incident bulletin says has already been observed in active attacks.

The flaw impacts every N‑central build older than version 2026.3.1.14, including installations that were patched with Hotfix 3 only a day before the new release. Because the vulnerability can be triggered without valid credentials, an attacker who reaches the management console could potentially run arbitrary commands on the underlying server.

The rapid succession of patches reflects the severity of the issue and the vendor’s effort to stay ahead of threat actors. Earlier this month N‑central received two separate hotfixes that addressed distinct security weaknesses, and the current update is the latest in that series. Security researchers who first disclosed the RCE bug have not publicly released a proof‑of‑concept, but the vendor’s notice suggests exploitation is already underway.

Administrators of on‑premises N‑central deployments are urged to apply Hotfix 4 without delay. The update not only closes the RCE vector but also includes a number of stability improvements. Companies are advised to test the hotfix in a controlled environment before rolling it out to production, while also reviewing network segmentation to limit exposure of the management console.

N-able’s release notes qualify the claim of active exploitation as “unconfirmed,” creating a degree of uncertainty that underscores the need for swift remediation. The firm said it will continue to monitor threat intelligence feeds and will provide additional guidance if further evidence emerges. In the meantime, the episode highlights the broader challenge of maintaining up‑to‑date security for critical IT‑management tools.