New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access

N-able is investigating claims of new vulnerabilities in on-premise versions of N-central, specifically version 2026.4.1 HF2. The issue reportedly relies on a non-default configuration where the Legacy API is enabled and exposed to the public internet. This configuration is not the default setting, according to N-able. The vulnerabilities could potentially allow for root remote code execution and Windows SYSTEM access. N-able has released an advisory regarding the matter, based on their initial review of the claims.