N-able N-central Zero-Day: Emergency Patching, Rogue Account Auditing, and RMM Defense Guide

N-able has released emergency patches for a critical vulnerability in N-central, its remote monitoring and management (RMM) platform, that was exploited as a zero-day before a fix was available. The vendor's guidance includes a telling instruction: administrators should check their N-central deployments for newly created user accounts they don't recognize — a strong indicator that successful exploitation can result in unauthorized account creation and persistent administrative access to the platform.

This should get your attention immediately. N-central is not a peripheral application. It is the platform your IT operations team uses to push scripts, deploy software, and manage every endpoint and server in your environment — and for MSPs, every endpoint in every customer environment. A compromised RMM is the worst-case lateral movement scenario: it converts a single vulnerability into fleet-wide code execution with legitimate credentials and signed binaries.

If you run N-central on-premises or rely on an MSP that does, treat this as an incident, not a patch Tuesday item.

Why RMM Zero-Days Are a Defensive Emergency

I've led IR engagements across ransomware, nation-state intrusions, and supply-chain compromises, and RMM compromise is the connective tissue in the worst of them. From the defender's seat, an attacker who owns your RMM has:

• Authenticated, high-privilege code execution on every managed endpoint, delivered through a channel your EDR is often configured to trust.
• A persistence mechanism that survives endpoint reimaging — rogue admin accounts in the RMM console let attackers redeploy at will.
• MSP blast radius. If you're an MSP, one exploited N-central instance can become a supply-chain event affecting your entire customer base.
• Detection evasion. Activity executed through the RMM looks like legitimate administration. Scripts pushed through N-central use the same tooling your techs use daily.

The vendor's advice to look for unknown user accounts tells us the exploitation chain culminates in account creation — the attacker's way of converting a transient exploit into durable access. That is exactly the artifact defenders should be hunting right now, even after patching.

Technical Analysis

Affected Product

• Product: N-able N-central (RMM platform), including on-premises deployments. MSP-hosted and cloud instances are patched by N-able; on-prem customers are responsible for applying the fix themselves.
• Risk: Unauthenticated or low-authentication remote exploitation leading to administrative access and unauthorized user account creation on the N-central server.

Attack Chain (Defender's View)

While full technical details remain limited in the public advisory, the observable chain implied by the vendor guidance is:

1. Initial access: Exploitation of the critical flaw against an internet-facing or internally reachable N-central server.
2. Privilege escalation / platform access: The attacker obtains administrative-level control of the N-central application.
3. Persistence: Creation of a new user account in the N-central console — the artifact N-able explicitly tells administrators to look for.
4. Follow-on actions (if undetected): Script deployment, software push, or remote session initiation to managed endpoints under attacker control, all riding the trusted RMM channel.

Exploitation Status

This vulnerability was exploited in the wild as a zero-day before the patch was released. That means there is a pre-patch exploitation window for every exposed deployment, and patching alone does not confirm you are clean — you must hunt for artifacts left behind during that window. Check the CISA Known Exploited Vulnerabilities catalog for current KEV status and any associated federal remediation deadlines, and monitor the N-able security advisories page for updated technical details, fixed build numbers, and indicators of compromise as they are published.

Detection & Response

The detection strategy here has two prongs: (1) find rogue accounts and suspicious administrative activity in N-central itself, and (2) catch the downstream behaviors — account creation and command execution on the N-central server and managed endpoints that don't match your normal administrative patterns.

Sigma Rules

---
title: Suspicious Local User Account Creation on N-central Server
id: 3f8a2b41-7c1e-4d59-9a06-2e7f5c8b1d42
status: experimental
description: Detects local user account creation via command line or PowerShell on servers hosting the N-able N-central platform. Attackers exploiting the N-central zero-day may create local accounts on the RMM server for persistence, in addition to console-level accounts.
references:
  - https://www.securityweek.com/n-able-patches-critical-zero-day-in-n-central/
  - https://attack.mitre.org/techniques/T1136/001/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_net:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - ' user '
      - ' /add'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'New-LocalUser'
      - 'New-ADUser'
  condition: 1 of selection_*
falsepositives:
  - Legitimate provisioning scripts and onboarding automation
  - Filter to N-central servers and alert immediately rather than tuning out
level: high
---
title: N-central Process Spawning Command Shell or Scripting Engine
id: 9c4d7e12-5a38-4f6b-b281-6d3a0f9e7c55
status: experimental
description: Detects N-able N-central server or agent processes spawning cmd.exe, PowerShell, or other scripting engines. While RMM-driven script execution is expected behavior, execution chains originating from unexpected N-central components or at unusual times may indicate post-exploitation activity following the zero-day compromise.
references:
  - https://www.securityweek.com/n-able-patches-critical-zero-day-in-n-central/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.execution
  - attack.t1059
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'nable'
      - 'n-central'
      - 'ncentral'
      - 'solarwindsmsp'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_known:
    CommandLine|contains:
      - 'N-able Technologies'
  condition: selection_parent and selection_child and not filter_known
falsepositives:
  - Scheduled maintenance scripts and automation policies pushed through N-central
  - Baselining your MSP's routine script execution is essential; investigate executions outside maintenance windows or with obfuscated command lines
level: medium
---
title: N-central Server Process Making Outbound Connection to Unusual Destination
id: 6b1e9f38-2d74-4a5c-8e90-4f2c7b6a3d18
status: experimental
description: Detects the N-central server process establishing outbound network connections. Post-exploitation activity such as tool staging, C2, or data staging may manifest as unexpected egress from the RMM server. Correlate destination reputation and history before dismissing.
references:
  - https://www.securityweek.com/n-able-patches-critical-zero-day-in-n-central/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - 'nable'
      - 'n-central'
      - 'ncentral'
    Initiated: 'true'
  filter_loopback:
    DestinationIp|cidr:
      - '127.0.0.0/8'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_loopback
falsepositives:
  - Legitimate N-central cloud communication, update servers, and remote session infrastructure
  - Enrich with destination domain age and reputation; suppress only after verifying vendor-owned destinations
level: low

KQL — Microsoft Sentinel / Defender

This hunt pulls together the two most reliable post-exploitation signals: new account creation on N-central infrastructure and suspicious child processes spawned by N-central components. Run it across a lookback window that covers your pre-patch exposure period — do not limit it to the last 24 hours.

let Lookback = 30d;
// Part 1: Local account creation events on N-central servers
let NcentralHosts = (DeviceInfo
    | where TimeGenerated > ago(Lookback)
    | summarize by DeviceName, DeviceId);
let NewAccounts = (SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4720
    | project AccountCreatedTime=TimeGenerated, Computer, NewAccount=TargetUserName, CreatedBy=SubjectUserName, CreatedByDomain=SubjectDomainName);
NewAccounts
| join kind=inner NcentralHosts on $left.Computer == $right.DeviceName
| project AccountCreatedTime, Computer, NewAccount, CreatedBy, CreatedByDomain
| sort by AccountCreatedTime desc;
// Part 2: N-central processes spawning shells or scripting engines
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFolderPath has_any ("nable", "n-central", "ncentral", "solarwindsmsp")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "net.exe", "net1.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| sort by TimeGenerated desc

Review every row in Part 1 against your change management records. Any account not traceable to a ticketed admin action is a compromise indicator — disable it, preserve logs, and open an IR case.

Velociraptor VQL

Use this hunt artifact across the N-central server and managed endpoints to enumerate recently created local user profile directories and inventory N-central-related processes with their command lines for triage.

-- Hunt: N-central post-exploitation triage
-- 1. Enumerate user profile directories created recently (rogue local accounts create profiles on first logon)
LET profiles = SELECT FullPath, Mtime AS ProfileModified
FROM glob(globs='C:/Users/*')
WHERE NOT IsDir = False
  AND Mtime > (now() - 2592000)
  AND NOT FullPath =~ '(?i)(Public|Default|All Users)$'

SELECT * FROM profiles

-- 2. Inventory running N-central components and any shell/scripting children
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(nable|n-central|ncentral|solarwindsmsp)'
   OR Name =~ '(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta|net|net1)\.exe$'
ORDER BY CreateTime DESC

Correlate profile creation timestamps against your patch timeline. A profile created on the N-central server during the pre-patch window by an account your team doesn't recognize is a strong post-exploitation artifact.

Verification & Hardening Script

Run this PowerShell script (as Administrator) on your N-central server to audit for rogue accounts, confirm the installed version, and surface recent account-creation events for review.

# N-central post-patch verification and rogue account audit
# Run elevated on the N-central server

$ReportPath = "C:\Temp\NCentral_Audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
New-Item -Path 'C:\Temp' -ItemType Directory -Force | Out-Null

"=== N-central Security Audit - $(Get-Date) ===" | Out-File $ReportPath

# 1. Installed N-central version (verify against the fixed build in N-able's advisory)
"`n--- Installed N-central Version ---" | Out-File $ReportPath -Append
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match 'N-central|N-able' } |
  Select-Object DisplayName, DisplayVersion, InstallDate |
  Format-Table -AutoSize | Out-File $ReportPath -Append

# 2. Local user accounts - flag anything you don't recognize
"`n--- Local User Accounts ---" | Out-File $ReportPath -Append
Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSet, Description |
  Format-Table -AutoSize | Out-File $ReportPath -Append

# 3. Local Administrators group membership - every entry must be justified
"`n--- Local Administrators Membership ---" | Out-File $ReportPath -Append
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
  Select-Object Name, ObjectClass, PrincipalSource |
  Format-Table -AutoSize | Out-File $ReportPath -Append

# 4. Account creation events (Event 4720) in the last 30 days
"`n--- Account Creation Events (Last 30 Days) ---" | Out-File $ReportPath -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, @{N='NewAccount';E={$_.Properties[0].Value}}, @{N='CreatedBy';E={$_.Properties[4].Value}} |
  Format-Table -AutoSize | Out-File $ReportPath -Append

Write-Host "Audit complete. Review $ReportPath and reconcile every account against change records." -ForegroundColor Yellow

Remediation

1. Patch immediately. Apply the fixed N-central build per N-able's security advisory. On-premises instances are your responsibility — do not wait for a maintenance window. Cloud/hosted instances are patched by N-able, but confirm with your account team that your instance has been updated. Check the CISA KEV catalog for listing status and mandated remediation timelines.
2. Audit N-central console accounts. Log into the N-central console and enumerate every user account. Disable and investigate any account you cannot tie to a named administrator and a change ticket. This is the vendor's explicit guidance — treat any unknown account as confirmed compromise until proven otherwise.
3. Audit local accounts on the N-central server using the script above. Rogue OS-level accounts are a secondary persistence mechanism.
4. Force credential rotation. Reset passwords for all N-central console administrators, and rotate any API keys, integration tokens, and service accounts the platform uses. If you find evidence of compromise, rotate domain credentials for any account that authenticated through the RMM.
5. Enforce MFA on all N-central console access and restrict console login to named admin accounts from managed networks (IP allowlisting where supported).
6. Restrict network exposure. The N-central server should never be broadly internet-exposed. Limit inbound access to required ports from known source ranges, place it behind a VPN or zero-trust access gateway, and egress-filter outbound connections from the RMM server.
7. Review pushed content. Audit recent scripts, software deployments, scheduled tasks, and automation policies in N-central for anything your team did not create — attacker-deployed scripts are the primary post-compromise payload.
8. Preserve evidence before cleanup. If you find rogue accounts or unexplained activity, image the server and export application and security logs before deleting anything. You are now in incident response territory, and the blast radius question ("did they push anything to endpoints?") requires forensics, not guesswork.
9. MSPs: notify downstream customers if any compromise indicators are found. An exploited MSP RMM is a supply-chain incident, and your customers need the opportunity to hunt their own endpoints.

The Bottom Line

RMM platforms are the crown jewels of enterprise IT — which is exactly why adversaries burn zero-days on them. Patch N-central now, but understand that patching closes the door; it does not tell you whether anyone already walked through it. The account audit, credential rotation, and endpoint script review above are not optional follow-ups — they are the difference between a patched vulnerability and an undetected breach living inside your management plane.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub