RMM Platforms Under Siege: N-able, MikroTik Exploits Demand Action

Remote Management Infrastructure: The New High-Value Target

This Labor Day week brings troubling news for organizations relying on remote management platforms: attackers are systematically exploiting critical flaws in tools that IT teams depend on to secure and maintain their infrastructure. N-able has released its fourth emergency hotfix in five weeks for a maximum-severity remote code execution vulnerability in N-central, while hackers are actively hijacking MikroTik routers through internet-exposed SSH services. Both campaigns are confirmed to be exploited in the wild.

The pattern is clear: remote monitoring and management (RMM) platforms and network infrastructure devices have become priority targets because compromising them grants attackers broad access to entire networks. When the tools meant to protect your environment become the entry point, the blast radius is enormous.

N-able N-central: Four Patches, Five Weeks

N-able's situation illustrates how quickly a security incident can spiral. Every on-premises N-central installation below version 2026.3.1.14 requires immediate patching with Hotfix 4—including servers that were updated to Hotfix 3 just one day earlier. The company's incident notice confirms active exploitation, meaning attackers are already using this vulnerability against real targets.

For organizations running N-central, this represents a critical decision point. Unauthenticated remote code execution means an attacker needs no credentials to take control of your RMM platform. Once inside, they have the keys to your entire managed infrastructure: endpoints, servers, credentials, and administrative access across client environments.

Immediate Actions for N-central Users

• Patch immediately: Deploy Hotfix 4 (2026.3.1.14) without delay, regardless of whether you installed Hotfix 3
• Review access logs: Check for unauthorized access attempts or suspicious administrative activity from the past five weeks
• Audit RMM permissions: Verify which accounts have administrative access and whether multi-factor authentication is enforced
• Segment RMM infrastructure: If your N-central server sits on the same network segment as general infrastructure, isolate it behind additional access controls
• Consider on-prem vs. cloud: Evaluate whether your organization has the resources to maintain security updates for self-hosted RMM platforms

The rapid succession of patches suggests N-able is working through a complex vulnerability or family of related issues. Organizations should expect continued scrutiny of this platform and plan for additional updates.

MikroTik Routers: Authentication Bypass via SSH

Attackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik RouterOS to gain full administrative control without authentication. The attack targets routers with SSH services exposed to the internet, allowing complete device hijacking.

MikroTik routers are ubiquitous in small and medium businesses, ISPs, and managed service provider networks. They're cost-effective, powerful, and—when misconfigured—dangerously exposed. This exploit chain demonstrates why perimeter security devices require the same rigorous hardening as internal systems.

Why This Matters Beyond MikroTik

Router compromise provides attackers with several strategic advantages:

• Traffic interception: Full visibility into all network communications, including credentials and sensitive data
• Persistent access: Routers rarely undergo the same security monitoring as servers and workstations
• Lateral movement: Compromised routers can be used to pivot into internal networks or manipulate routing to redirect traffic
• Botnet recruitment: Hijacked routers often become nodes in larger attack infrastructure

The fact that this is an unauthenticated exploit accessible via internet-exposed SSH makes it particularly dangerous. Automated scanning tools can identify vulnerable devices at scale, and exploitation requires minimal skill.

Securing Network Infrastructure

If your organization uses MikroTik routers or any network devices with management interfaces:

• Update immediately: Apply the latest RouterOS patches addressing these vulnerabilities
• Disable internet-facing SSH: Management interfaces should never be directly accessible from the internet
• Use VPN or jump hosts: Require administrative access through a VPN or secure jump host with MFA
• Enable logging and monitoring: Configure syslog forwarding to a centralized logging system and monitor for configuration changes
• Regular configuration audits: Review device configurations quarterly to identify unnecessary services or misconfigurations
• Default credentials: Verify that all network devices use unique, complex passwords and that default credentials have been changed

ConnectWise ScreenConnect: Another RMM Under Pressure

Adding to the RMM security concerns, ConnectWise has disclosed a new ScreenConnect vulnerability for which no patch is yet available. The company has shared temporary mitigation measures while working on a fix expected later this week.

This follows a pattern we've observed throughout 2026: RMM and remote access platforms are under sustained pressure from attackers. The tools that enable remote work and efficient IT management have become critical infrastructure that demands enterprise-grade security practices.

The Broader RMM Security Challenge

These incidents raise fundamental questions about how organizations approach RMM security:

Trust architecture: RMM platforms operate with broad, privileged access across your environment. Are you treating them with the same security rigor as domain controllers?

Vendor response time: When vulnerabilities emerge, how quickly can your RMM vendor patch them, and how quickly can you deploy those patches?

Exposure management: Are management interfaces properly segmented and protected, or are they accessible from the broader internet?

Monitoring and detection: Do you have visibility into RMM platform activity, or would a compromise go unnoticed?

Building Resilient Management Infrastructure

Organizations dependent on RMM platforms and network management tools should implement defense-in-depth strategies:

1. Assume compromise: Design monitoring and response procedures that can detect and contain an RMM platform breach
2. Principle of least privilege: Limit RMM administrative access to only those accounts that require it, with time-limited elevation where possible
3. Network segmentation: Isolate management infrastructure on dedicated network segments with strict access controls
4. Regular security assessments: Include RMM platforms and network devices in penetration testing and vulnerability assessments
5. Incident response planning: Develop and test procedures for responding to compromised management infrastructure

The convergence of N-able, MikroTik, and ConnectWise vulnerabilities in a single week isn't coincidence—it reflects where attackers are focusing their research and exploitation efforts. Organizations that depend on these platforms need to respond with urgency and sustained attention to security fundamentals.

If you're concerned about your RMM security posture or need help assessing network infrastructure vulnerabilities, Vici Tech Solutions provides penetration testing and security assessments specifically designed to identify these high-impact risks before attackers do.