Patching alone may not clean up a compromised N-central host, since attackers were already running cryptocurrency miners on systems that had the latest hotfix.
N-able urges customers to disable the Legacy API now, since the server-side attack depends on that non-default setting being enabled and exposed to the internet.
Customers on both hosted and on-premises N-central must stay offline until a hotfix is confirmed, which N-able expects around midday on November 10.