N-able warns of N-central auth bypass flaw exploited in attacks

N-able is warning customers that hackers are exploiting an authentication bypass vulnerability (CVE-2026-18577) affecting both hosted and on-premises N-central servers.

The company on Sunday released hotfix 2026.3.1.7 to address the security issue, which affects all versions of N-central before 2026.3.

On August 1st, the vendor disclosed that it detected active exploitation and launched an investigation that uncovered additional security concerns affecting all versions of N-central, its flagship Remote Monitoring and Management (RMM) platform.

In an update the next day, the company announced the hotfix and strongly recommended all customers to upgrade immediately to the new release.

Hosted deployments already received the update, while customers of on-premises instances need to install it manually.

N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) and corporate IT departments to manage large clusters of multi-OS systems and network devices.

Because of this, compromising these servers allows threat actors to extend the attack beyond N-able’s direct customers.

The product was also targeted last year, in zero-day attacks that prompted CISA to issue an urgent alert.

In the past, threat actors compromised other notable RMM/MSP platforms, including Kaseya VSA, ConnectWise ScreenConnect, SimpleHelp, and SolarWinds Orion.

CVE-2026-18577 is the result of an incomplete patch for CVE-2026-18576, a vulnerability described as an “authentication bypass using an alternate path or channel, which affected all N-central versions through 2026.1. Both vulnerabilities could be exploited for administrative account takeover.

N-able has not shared any technical details about the security issue or provided information about the number of customers targeted or compromised through CVE-2026-18577.

The vendor provided indicators of compromise on the hotfix download page, including four specific IP addresses, a registered service named ‘Cloudflared,’ and ‘svchost.exe’ in the users’ documents folder.

If any of these are found, customers are advised to contact N-able support immediately and engage their own security team.

It should be noted that attackers frequently abuse Cloudflared, the legitimate tunneling utility from Cloudflare, to create outbound tunnels that expose compromised machines or provide remote access without opening inbound firewall ports.

The vendor also says that agents do not need immediate updates to mitigate CVE-2026-18577, but the action is recommended to get the latest fixes and features.

N-able’s status update “strongly recommends” that customers remain vigilant and monitor their environments closely, while the company also promised to share more updates as quickly as possible.

Test every layer before attackers do

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper