N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist
Summary: N-able released Hotfix 2 for N-central after detecting unusual activity in a customer environment on July 31, 2026, and finding unknown threat actors exploiting CVE-2026-18577 (CVSS 8.2), an authentication bypass and account takeover flaw affecting all versions prior to 2026.3.1.7. In the observed attacks, the actors gained remote administrative access, used the Take Control feature to reach managed systems, and registered a Cloudflare Tunnel service to persist after N-central server access was revoked.
What's compelling: Attackers who reach an RMM server inherit its reach into every managed endpoint, and the Cloudflare Tunnel they registered means revoking their N-central access does not evict them. N-able states a clean IoC scan is not a guarantee the environment is unaffected, so a limited number of confirmed victims may not be the full count.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-18556CVE-2026-18577
- Related