Your MSP's RMM tool just went dark: first-72-hours checks for downstream clients
Quick answer, Nov 10, 2026As of 10 November 2026, N-able has taken hosted N-central offline and tells on-premises customers to keep their servers offline. It says it has no evidence that any customer environment has been successfully exploited. If your managed service provider runs N-central, ask which deployment, whether it is offline, and what replaced it.
What N-able has said, and what it has not
N-central is a remote monitoring and management (RMM) platform: the tool a managed service provider (MSP) uses to reach, patch and script the machines it looks after. Your MSP's RMM tool has privileged access to your systems by design.
N-able's status page, read on 10 November 2026, lists an "N-central Critical Security Incident" as a "Major Outage", status "Investigating", covering hosted and on-premises N-central in the Americas, Europe and APAC. It says: "As expected, we are observing scanning activity associated with the published proof-of-concept code. At this time, we have no evidence that any customer environment has been successfully exploited." It gave a hotfix ETA of "Mid-day on November 10 (EST)" and recommends "that N-central remain offline until the hotfix is available and your server has been successfully upgraded."
BleepingComputer (9 November 2026) reports that a researcher published "more than 30 alleged zero-day vulnerabilities" with proof-of-concept exploits, and says it "has not independently verified all" of them. That count is the report's claim. N-able's page gives no count and no CVE IDs. N-able has not published a list of affected versions.
CISA's KEV catalog (JSON feed, catalog version 2026.11.09) lists five earlier N-central CVEs, the latest added on 8 September 2026. None was added after this disclosure.
Six checks for the first 72 hours
| Check | What to ask your MSP, or do yourself | Where it is written |
|---|---|---|
| 1. Exposure | Does the MSP run N-central for you, hosted or on-premises, and is it offline now? | AA22-131A, "Understand and proactively manage supply chain risk"; CSF 2.0 ID.AM-04 |
| 2. Standing access | Which MSP accounts and agents sit in your environment, and whether any are in your internal administrator groups | AA22-131A, "Manage account authentication and authorization"; CSF 2.0 PR.AA-05 |
| 3. Stand-in tools | Which remote tool the MSP uses while N-central is down, and whether you have authorized it | AA23-025A, "Mitigations" |
| 4. Monitoring | Who watches your endpoints while the RMM is dark, and where those logs go | CSF 2.0 DE.CM-06; AA22-131A, "Enable/improve monitoring and logging processes" |
| 5. Patching and backups | How security updates reach you this week, and whether you can restore without the RMM | AA22-131A, "Apply updates" and "Backup systems and data" |
| 6. Bring-back | The hotfix version, who confirmed the upgrade, and an administrator account review before reconnecting | N-able status page; AA22-131A, "Manage account authentication and authorization" |
Hours 0 to 24: find out whether it is your problem
If you do not know which RMM your MSP runs, ask in writing. AA22-131A, under "Understand and proactively manage supply chain risk", says customers should "understand the access their MSP has to their network and the data it houses." CSF 2.0 ID.AM-04 reads: "Inventories of services provided by suppliers are maintained." If the answer is N-central, ask whether it is hosted, which N-able has taken offline, or on-premises, which N-able tells customers to take offline themselves.
Then list what the MSP can do inside your network. AA22-131A, "Manage account authentication and authorization", says customers should "ensure MSP accounts are not assigned to internal administrator groups; instead, restrict MSP accounts to systems managed by the MSP." CSF 2.0 PR.AA-05 asks that access permissions incorporate "the principles of least privilege and separation of duties."
Hours 24 to 72: cover the gap without opening a new one
An outage pushes people toward workarounds. N-able's page lists N-able.app, Take Control from Asset View and on-demand Windows patching in preview as available in the meantime. Ask which of these, or which other tool, will touch your machines. AA23-025A's "Mitigations" section lists: "Audit remote access tools on your network to identify currently used and/or authorized RMM software." It also recommends allowlisting the authorized ones. A remote tool nobody approved is a second exposure.
Monitoring is the other gap. CSF 2.0 DE.CM-06: "External service provider activities and services are monitored to find potentially adverse events." AA22-131A, "Enable/improve monitoring and logging processes", recommends storing your most important logs "for at least six months", with visibility of the "provider's presence, activities, and connections to the customer networks."
Patching and recovery follow. AA22-131A, "Apply updates", says customers should "understand their MSP's policy on software updates." Under "Backup systems and data", it says backups belong in "a location that is air-gapped from the organizational network."
Before it comes back online
BleepingComputer reports the researcher's demonstration that one exploit chain can "create an enabled Default Administrator account with attacker-controlled credentials." N-able has not confirmed that detail. It is still the reason to ask, before the server reconnects to your machines: which hotfix version is installed, who verified it, and whether anyone reviewed the N-central administrator accounts. AA22-131A, "Manage account authentication and authorization", also says to "review logs for unexplained failed authentication attempts."
Where this sits next to the other pages
The contract side of the same problem, covering notification clauses and incident planning with suppliers, is in Third-party risk after a provider-led breach. If the vulnerable product is your own and it is on KEV, see Your VPN's MFA bypass is on CISA KEV. If a compromise has already reached you, see First 72 hours after ransomware.
From an AI assistant, the Distributed Risk MCP server runs search_kev against the catalog and list_cyber_advisories for CISA advisories naming a product. If you need people to cover monitoring or to look for evidence, the selection criteria are in Choosing a cyber crisis response firm, or brief an advisor and we arrange a partner firm that works in your region.
Questions
Our MSP does not use N-able. Does this apply? The six checks are product-neutral. AA22-131A is written for "MSPs and their Customers" generally, and any RMM platform holds the same kind of access.
Our MSP says no action is needed. Is that enough? Ask for it in writing: which deployment, its current state and which tool is in use instead. N-able's own page asks on-premises customers to take action.
Is this legal advice? No. This page is a procedural checklist drawn from the public record. Counsel decides what your contracts and your regulator require.