Threat Analysis: N-able Zero-Days, Cisco BroadWorks Exploitation, and the ClickFix Evolution
This is your Daily Threat Analysis for the 11th of November 2026.
Three items today. Two of them are directly relevant to any UK small business that relies on a managed IT provider or a hosted telephony platform, which, between them, covers the majority of the SMB market. The third is a social engineering evolution that your staff will encounter whether or not you think you are a target.
N-able N-central Zero-Days: The Tool Your MSP Uses to Manage Your Systems
N-able’s N-central is a remote monitoring and management platform. If you have a managed IT provider, there is a reasonable chance they use it, or something functionally identical, to access your systems, push updates, run scripts, and respond to incidents. That access is the entire point of the relationship. It is also, when it goes wrong, a single point of catastrophic failure.
Over the weekend of the 8th and 9th of November 2026, zero-day vulnerabilities in N-central were publicly disclosed. The disclosure was serious enough that N-able was forced to take vulnerable hosted environments offline while they developed a response. Hotfixes have now been released, as of the 11th of November 2026.
What the coverage says: hotfixes are available, MSPs should apply them.
What the coverage does not say: in the window between public disclosure and patch availability, any threat actor with knowledge of the vulnerabilities had the ability to target MSPs before those MSPs could defend themselves. RMM platforms are not simply a path to one victim. They are, by design, a path to every client the MSP manages. That is the attack surface. That is why ransomware groups have been systematically targeting RMM tools since at least 2022, and why the NCSC has published specific guidance on the risks posed by MSP compromise.
The NCSC published guidance on MSP supply chain risk. The fact we are still having this conversation tells you everything about how seriously organisations take it.
What to do:
- Contact your IT provider today and ask them specifically whether they use N-able N-central, and if so, whether the hotfixes released on the 11th of November 2026 have been applied to both their hosted and on-premises environments.
- Ask them what monitoring is in place to detect anomalous use of their remote access tools, including access from unusual locations or at unusual hours.
- If they cannot answer those questions clearly, that is itself diagnostic information about how they manage their own security posture.
If your IT provider tells you this does not affect you because they use a different RMM tool, that is not reassurance. Every major RMM platform has had significant vulnerabilities in the past three years. The question is not which tool, the question is what your provider’s patching discipline looks like and how they would notify you if their tools were compromised.
Cisco BroadWorks: CISA Confirms Active Exploitation
CISA added a Cisco BroadWorks authentication bypass vulnerability to its Known Exploited Vulnerabilities catalogue on the 11th of November 2026. KEV entries are not theoretical. CISA’s threshold for inclusion is confirmed, in-the-wild exploitation. If a vulnerability is on the KEV list, it is being used in active attacks right now.
BroadWorks is an enterprise communications platform. In practice, it underpins a large number of business telephony deployments, hosted PBX, unified communications, call centre infrastructure. Many UK SMBs interact with BroadWorks without knowing it, through their telecoms or unified communications reseller.
An authentication bypass in a telephony platform is not simply a phone system problem. BroadWorks environments typically integrate with directory services, single sign-on, and in some configurations, broader business applications. An attacker who bypasses authentication in a BroadWorks deployment has potential access to call records, voicemail, internal directories, and integration points that extend further than the telephony stack itself.
What the CISA advisory says: this vulnerability is being exploited, federal agencies must patch by the mandated deadline.
What it does not say: the advisory targets US federal agencies. UK businesses have no equivalent mandatory patching obligation through this channel. The practical implication is that UK telecoms resellers and hosted communications providers are not under the same regulatory pressure to move quickly. Some will. Some will not.
What to do:
- If you use a hosted business phone system or unified communications platform, contact your provider and ask whether BroadWorks is any part of your stack, and what their patch status is.
- Ask when they last conducted a security review of their BroadWorks deployment and what their notification process is in the event of a compromise.
- Review what BroadWorks integrates with in your environment. If it touches your Active Directory, your Microsoft 365 tenant, or any identity provider, the exposure extends beyond the phone system.
ClickFix Has Grown Up: What Started as a Clipboard Trick Is Now a Full Attack Chain
ClickFix is a social engineering technique that has been in use since 2024. The original mechanic was straightforward: a malicious website or document displays a fake error message, tells the user to press Windows Key + R and paste a command to fix it, and the user executes malware on their own machine because they were told it was a repair step.
Research published by Huntress on the 11th of November 2026 documents how substantially the technique has evolved. Current ClickFix campaigns are using malvertising through typosquatting, fake versions of legitimate websites appearing in search results, combined with SEO poisoning and compromised legitimate websites to deliver fake browser or software verification prompts. The payloads now include elaborate PowerShell scripts with animated progress bars designed to look like legitimate security checks while they execute in the background. The final stages have delivered remote access trojans including EtherRAT and AstarionRAT, as well as the Matanbuchus loader.
The advisory attributes this to multiple threat actors. What it does not say is that this technique works precisely because it engineers consent. The user is not being tricked into clicking something that looks wrong. They are being told, by something that looks entirely legitimate, that they need to take an action to fix a problem. The psychological mechanism is support-call familiarity, the same reason vishing calls that impersonate IT helpdesks work.
This matters for UK SMBs because the technique requires no vulnerability in your software. It requires a user, a browser, and a moment of reasonable-seeming urgency. Those are present in every business.
What to do:
- Brief your staff on the specific mechanic: if any website, pop-up, or prompt ever asks them to open a command prompt, PowerShell, or the Run dialogue and paste something in, that is an attack. Full stop. No legitimate software or security tool works this way.
- Restrict PowerShell execution policy on endpoints where full PowerShell access is not required for the role. For most office users, it is not required.
- Ensure web filtering is in place and that known malvertising and typosquatting domains are caught at the network layer rather than relying solely on user judgement.
Also Noted Today
The NCSC launched its new Cyber Adversary Simulation scheme on the 11th of November 2026, designed to help critical organisations test their defences through real-world simulation by vetted providers. This is aimed at larger organisations and critical national infrastructure rather than SMBs directly, but it is worth noting because the scheme represents the kind of adversary simulation testing that good MSPs should already be conducting on their own infrastructure, and asking your provider whether they do anything equivalent is a reasonable question.
Microsoft’s November 2026 Patch Tuesday was notable for scale: 1,328 vulnerabilities addressed, with 60 rated critical and 45 of those being remote code execution vulnerabilities. Cisco Talos published analysis on the 11th of November 2026. If your IT provider has not confirmed November patches are queued for deployment, that conversation is overdue. Microsoft also fixed the Exchange Server sign-in issues introduced by October’s Windows Server updates, and separately resolved USB audio problems that had persisted since September’s security updates, both resolved by the November 2026 cumulative updates.
Maersk, one of the world’s largest shipping companies, confirmed on the 11th of November 2026 that it is investigating an IT security incident involving suspected data theft. Maersk says it strongly suspects the attack is limited to a legacy system and that nothing sensitive is at risk. They said something similar in the early hours of NotPetya in 2017. This is worth watching, particularly if your business has supply chain exposure to major freight and logistics providers.
Sources
If this analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and if someone in your network needs to be having these conversations with their IT provider, send it to them today. It costs nothing and it might matter.