Attackers exploit N-able N-central flaw to reach managed endpoints (CVE-2026-18577)

Attackers are exploiting an authentication bypass vulnerability (CVE-2026-18577) in N-able N-central, a remote monitoring and management (RMM) solution widely used by managed service providers, to gain access to managed endpoints.

How the flaw was discovered

“On July 31, 2026, N‑able saw an increase in licensing issues for our on-premises N‑central customers. Licensing issues are not uncommon, but the volume was high and the engineering and security teams were engaged,” N-able shared.

“On the morning of August 2, 2026 our analysis of a previously addressed vulnerability (CVE-2026-18556), which was fixed in 2026.2, exposed another vector to exploit this vulnerability.”

The vendor assigned CVE-2026-18577 to this new flaw and confirmed that it affects all N-central versions prior to version 2026.3.1.7 (i.e., 2026.3 Hotfix 1).

The hotfix is pushed to and implemented automatically on N-central instances hosted by the vendor, while customers must implement the fix themselves on their self-hosted deployments.

Active exploitation, slow patching

N-able says that attackers breached installations of a “limited” number of customers, took over an admin account, and abused the Take Control feature to connect to managed endpoints.

“Once on those devices, the attackers registered a new service for a CloudFlare tunnel, enabling persistence into an environment after access to the N‑central server was revoked,” the company discovered.

Huntress, a managed cybersecurity firm that focuses on small and mid-sized businesses and the MSPs that serve them, has confirmed that CVE-2026-18577 exploitation is ongoing.

The company said it had seen exploitation affecting one organization in its own customer base, and that it was continuing to hunt for N-central-related activity across its telemetry and to review logs matching the tradecraft N-able described.

“Beyond this specific vulnerability, we are seeing many environments where the N-central Server has yet to be updated to the 2026.3.1.7 hotfix needed to prevent exploitation of the vulnerability,” Huntress researchers noted on Monday.

“At the time of posting this update, more than half (55.6%) of our partners’ and customers’ reachable cloud servers were still unpatched. That is especially concerning because the N-able server runs a custom distribution of AlmaLinux 9, and does not often have EDR software deployed on it due to running as an appliance.”

Detection and mitigation

RMM tools are a great target for attackers who want to reach into many organizations to prepare the ground for later attacks or deeper into one target organizations.

This is not the first time that attackers have targeted N-central vulnerabilities.

Organizations with self-hosted N-central servers should upgrade to the fixed version and check the server for signs of admin-account takeover. They should also inspect the endpoints managed through N-central, since that’s where the attackers established persistence.

“To detect if you have been impacted, review the Documents folder on managed devices for a file called ‘svchost.exe’, and look for a registered service named ‘Cloudflared’,” N-able instructed.

The company has shared a list of IP addresses used by the attackers.

According to Huntress, the flaw gives attackers the same level of control normally reserved for trusted network operation and engineering staff. It allows them to do things like push new scripts and jobs to managed endpoints, deploy and run dual-use tools such as remote tunnels or discovery utilities via the N-able agent, and initiate remote-control sessions into servers and workstations (including domain controllers and other critical systems).

They can also alter security-relevant configuration – roles, accounts, and policies – to pave the way for follow-on activity, the researchers added.

So far, the observed activity related to these attacks has centered on establishing persistence on managed endpoints.

Huntress advises potentially affected organizations to isolate their N-central deployments; update and harden them; look for unusual logins, account and permission changes, new or modified jobs and automation; and review recent Take Control sessions.

“Turning off N-central is a significant decision, and it should be made based on risk, not panic. On one side, a compromised RMM can be used as a force multiplier against every downstream client you manage; on the other, taking N-central offline means losing central visibility, patching, and remote access when they may be needed most,” Huntress analysts noted.

“Our goal is not to tell every N-able customer to shut down their RMM, but to make sure you consciously weigh this option: for higher-risk environments, or where you cannot meaningfully reduce exposure, temporarily disabling N-central until you are able to apply N-able’s hotfix may be the safer choice.”

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!