N-able Plans to Remove N-central's Legacy API After Attackers Hit Servers Running Its Hotfix

N-able plans to permanently remove N-central's Legacy API after attackers used a new exploit chain to install cryptocurrency miners on servers that had already received its emergency hotfix. The remote management software gives IT providers access to customer machines, making a compromised server more than a source of free computing power.

In a November 13 remediation update, N-able said its forthcoming HF3 will eliminate the older interface and strengthen authentication between agents, probes and appliances. The fix was still being developed in that announcement.

The hotfix did not end the attacks

Huntback's November 12 investigation found 21 active mining rigs associated with N-central servers. Nineteen reported build 2026.4.1.26, the HF2 release shipped on November 10. That is a snapshot of one observed operation, not a count of every affected installation.

The researchers saw initial probes on their decoys roughly four and a half hours after the 4EverAble2Shell proof of concept appeared. The observed chain moved from remote code execution to root privileges and installed an XMRig Monero miner. Huntback reported mining as the payload it observed, without claiming that the attacker had compromised every customer endpoint managed by those servers.

The critical condition is the Legacy API. N-able says it is disabled by default and was retained for customers who explicitly needed older operations. A server running HF2 could still be exposed when that interface was enabled.

Older integrations are paying the price

N-able's separate November 13 security update tells on-premises customers to ensure Legacy API access is disabled. It also describes temporary restrictions on Intune integration while additional protections are validated. Hosted environments received protections directly; customers still need to follow the earlier instructions to upgrade agents and probes.

The same notice publishes compromise indicators associated with the miner campaign. Turning off the entry point does not establish whether an intruder already gained access.

HF3 is also intended to strengthen permission checks and limit agent impersonation. For now, the vendor's response combines an existing hotfix with restricted functionality, while the next update is set to retire the legacy interface entirely.

Some offers on this page may be paid placements or contain affiliate links.