- Engineer — Act: If you run N-central, apply the emergency hotfix immediately — max-severity RCE with reported ongoing attacks on an RMM platform is a critical-priority patch with no waiting window.
- SOC/IR — Act: Active exploitation of an RMM platform is an assume-breach trigger: hunt for unauthorized lateral movement or remote execution originating from N-central agents across managed endpoints since before the patch window.
- Leader — Act: Confirm whether your organization or any MSP you rely on runs N-central, and request attestation that the emergency hotfix has been applied — RMM compromise has cascading supply-chain risk to all managed systems.