official guidance (N-able advisory as quoted by Huntress, Nov 12, 2026)
Tip: on N-central 2026.4 HF2, confirm Legacy API is off before you put the server back online
- IP allowlisting alone is weak here: Huntress notes the affected endpoints are the ones Agents and Probes use to check in.
- If Legacy API was on and exposed after Nov 11, run the hunt before trusting the server.
Sources: Huntress: N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains (updated Nov 12, 1:10 AM and 6:30 AM ET)