A patch that didn't hold
N-able builds N-central, remote monitoring and management (RMM) software that managed service providers (MSPs) and corporate IT teams use to administer client computers from a single console. RMM platforms exist precisely so one console can reach many machines across many client networks at once, which is what makes them useful day to day and what makes a break-in at the console so much worse than a typical server compromise. That console is now the center of an active exploitation campaign that outlasted the vendor's first attempt to fix it.
The root problem, tracked as CVE-2026-18556 and classified under CWE-288, "authentication bypass using an alternate path or channel," let an unauthenticated attacker with network access to an N-central server reach it through a path the login screen wasn't supposed to expose and land with a fully administrative account, no credentials required. N-able rated it 8.2 out of 10 on the CVSS 4.0 scale and shipped a fix in version 2026.2 covering releases through 2026.1.
That fix did not close the door. Attackers found a second route into the same underlying flaw, and N-able has assigned it its own identifier, CVE-2026-18577. The company first noticed something was wrong on July 31, when customers began reporting unusual licensing errors. By August 1 it had confirmed active exploitation and opened an investigation; a day later it shipped build 2026.3.1.7, the first version closed to both bypass paths. The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-18577 to its Known Exploited Vulnerabilities catalog on August 3.
What attackers did once inside
With administrative access to an N-central console, an attacker inherits everything that console is trusted to do to every machine it manages. According to incident detail published by the cybersecurity firm Huntress, attackers used N-central's built-in Take Control feature to remote into managed endpoints, ran reconnaissance aimed specifically at domain controllers, and pulled process lists before disconnecting.
On at least some of those endpoints they planted persistence that no longer depends on holding the N-central account at all: a Windows service registered under the name "Cloudflared," standing up a Cloudflare Tunnel back to attacker infrastructure. A tunnel like that survives a reboot and gives the attacker a channel back in even if N-able's own access is later revoked. Huntress traced the activity to six IP addresses, four of them identified as Mullvad or NordVPN exit nodes, and found at least one compromised self-hosted N-central instance whose reach extended to nine separate client organizations downstream, with one endpoint touched at each.
N-able has not said how many customers were affected in total, and has not detailed how attackers first discovered the bypass to the original patch.
Who's still exposed
N-central runs in two flavors: N-able's own cloud-hosted instances, which were patched automatically, and self-hosted installs, which are not. As of August 3, the day after the hotfix shipped, Huntress reported that 13.6% of internet-reachable N-central servers overall remained unpatched, rising to 28.6% among self-hosted deployments specifically. Both figures will fall as the fix propagates, but they mark the exposure window that was still open a full day after N-able had a working fix in hand. Both CVE-2026-18556 and CVE-2026-18577 carry the same 8.2 CVSS 4.0 score, since they are two doors into the same underlying design flaw rather than two unrelated bugs.
The pattern is the one that makes RMM software a preferred target regardless of the specific vendor: one console is trusted by design to reach many downstream networks, so a single successful bypass at the console can fan out to every organization it manages. That is also why CISA's decision to add CVE-2026-18577 to its Known Exploited Vulnerabilities catalog carries weight beyond N-able's own customer base: US federal civilian agencies are required to remediate KEV-listed flaws on a fixed deadline, and the listing tends to push enterprise security teams elsewhere to treat the bug as an immediate priority rather than routine patching.
What to do
Organizations running N-central on-premises should upgrade to 2026.3.1.7 immediately rather than wait for a scheduled maintenance window; hosted customers were patched automatically but should confirm their build number regardless. Administrators should also review N-central and Take Control session logs for connections from unrecognized IP addresses, check managed endpoints for a service named "Cloudflared" that the organization did not deploy itself, and treat Windows Event Log IDs 4102, 8192 and 8193 as indicators worth investigating, since Huntress has tied them to Take Control abuse in this campaign. Given that attackers specifically targeted domain controllers once inside, any confirmed compromise warrants a broader credential and Active Directory review, not just cleanup of the N-central server itself.
