Patch N-able N-central now: vendor confirms active exploitation of authentication bypass flaw

N-able has confirmed active exploitation of an authentication bypass vulnerability, tracked as CVE-2026-18577, in its N-central remote monitoring and management platform. Attackers exploiting the flaw gained unauthenticated administrative access to N-central servers and abused the built-in Take Control feature to reach devices those servers manage. A complete fix exists: N-able's second hotfix, build 2026.3.1.10, released Aug. 6, 2026, supersedes an earlier patch that did not fully close the hole.

Fact	Detail
CVE ID	CVE-2026-18577
Affected product	N-able N-central, all instances not running build 2026.3.1.10 (Hotfix 2)
Severity	CVSS 8.2, per Rapid7's advisory
Exploitation status	Actively exploited, confirmed by N-able
Fix status	Vendor-confirmed fix available (Hotfix 2, Aug. 6, 2026); cloud-hosted instances patched automatically, self-hosted instances require manual action

What happened?

N-able's Adlumin MDR service detected unusual activity inside a customer environment on July 31, 2026, and traced it to a threat actor exploiting a previously unknown flaw in N-central, according to N-able's security update. The company registered CVE-2026-18556 on Aug. 1 and shipped an initial fix, but while investigating that issue its team found the patch was incomplete. A second, related bypass, CVE-2026-18577, was registered on Aug. 2, and N-able released Hotfix 1 (build 2026.3.1.7) the same day.

That still was not the end of it. On Aug. 6, N-able said it discovered an additional attack path and released Hotfix 2 (build 2026.3.1.10) with further hardening, calling it the fix partners should apply now. Independent researchers at Rapid7 confirmed exploitation had been ongoing since Aug. 1, with attackers using N-central's Take Control feature to reach managed endpoints and deploying Cloudflare Tunnel to keep remote access open. Security firm Huntress separately tracked a consistent attack pattern across affected customers: reconnaissance aimed at domain controllers, process enumeration, then rapid lateral movement to other hosts. N-able has said only a limited number of customers were compromised but has not disclosed a total count.

Am I affected?

Any organization running a self-hosted N-central instance that has not applied build 2026.3.1.10 is at risk, whether or not it has been targeted yet. N-able's cloud-hosted (NCOD) customers received the fix automatically, per N-able's status page, but should still confirm their instance shows the current build number before assuming they are covered.

What should I do right now?

1. Open your N-central admin console and check the build number under the About or System Info screen. If it does not read 2026.3.1.10 or later, patching is not complete.
2. Self-hosted customers: download Hotfix 2 from N-able's partner portal and apply it immediately; N-able's documentation lists supported upgrade paths from versions 2025.4, 2026.1, 2026.2, and 2026.3.
3. After patching, assume compromise is possible and look for indicators N-able and Rapid7 have published: a file named svchost.exe inside a Documents folder, an unfamiliar service named Cloudflared, and unexpected administrative accounts or password resets.
4. Enforce multi-factor authentication on all N-central accounts and disable any in-product support accounts that are not actively needed.
5. Review authentication logs and Take Control session history for activity you cannot account for, and treat any match on the indicators above as a likely breach requiring incident response, not just a patch.

Is this different from the first patch?

Yes. CVE-2026-18556 and CVE-2026-18577 describe two related but distinct authentication bypass paths in N-central, and N-able's Aug. 2 hotfix addressed only the first. Applying Hotfix 2 closes the vulnerability going forward, but N-able has been explicit that it does not remove a threat actor who gained access before the patch was applied — that requires separate account and endpoint review.

For a related threats perspective, read NIST Awards Over $1.2 Million to Small Businesses.