N‑able N‑central Under Attack: CVE‑2026‑18577 Exploited to Bypass Prior Patch

The Alarm Went Off Between Late July and August 2

Initial signs appeared in the last days of July, when some IT service providers noticed licensing anomalies on their N‑central servers. By July 31 the irregularities became harder to ignore, and on August 2 N‑able confirmed active exploitation: a new authentication bypass tracked as CVE‑2026‑18577 was being used against on‑premises and cloud‑hosted deployments of the RMM platform. Huntress, a threat hunting company, subsequently released Indicators of Compromise (IoCs) related to the observed attacks.

A Flaw That Renders the CVE‑2026‑18556 Fix Ineffective

The vulnerability affects N‑central in all versions before 2026.3.1.7. It is a double‑edged issue – not a simple privilege escalation but a mechanism that fully bypasses authentication, letting an attacker gain administrative access without valid credentials. The severity is compounded by the fact that CVE‑2026‑18577 evades the protection introduced for CVE‑2026‑18556, a previously patched weakness. As a result, even systems that had promptly applied that patch remained exposed to the new attack.

Attackers Become Administrators and Abuse Take Control

After obtaining NOC or engineering‑level privileges on the N‑central console, the threat actors abused the Take Control feature to connect directly to managed endpoints: servers, workstations, and, in some cases, domain controllers. Leveraging the pre‑existing N‑able agent, they deployed a malicious service that establishes a CloudFlare tunnel, securing a persistent communication channel to the compromised infrastructure. This architecture allows them to maintain control even after access to the N‑central server is revoked or the administrative session is terminated.

The misuse of dual‑use tools and tampering with roles, accounts, and security policies lays the groundwork for lateral movement, data exfiltration, or future malicious actions. As of August 3, several organisations had not yet applied the update, although the overall number of victims remains limited.

Patch Immediately, Hunt for Suspicious CloudFlare Tunnels

N‑able has released N‑central version 2026.3.1.7, which resolves the flaw. Applying it to all on‑premises and cloud servers without delay is critical, ensuring the upgrade completes successfully. In parallel, security teams must:

• examine authentication logs and changes to roles and policies,
• search for unauthorised services, especially those tied to undocumented CloudFlare tunnels,
• compare assets against IoCs published by Huntress and N‑able,
• limit web exposure of the N‑central console so that it is reachable only from trusted networks.

Rapid patching combined with thorough inspection of managed endpoints is the only way to contain a threat that continues to evolve.