New N-central exploits work against patched servers, enable root RCE and Windows SYSTEM access

N-able is investigating publicly disclosed claims of additional vulnerabilities in on-premise versions of N-central. The issue depends on a non-default configuration in which the Legacy API is enabled and exposed to the public internet. N-able is urging customers to disable the Legacy API immediately. Hosted environments are not affected.