CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises
Summary: CISA added CVE-2026-18577, a CVSS 8.2 authentication bypass and account takeover flaw in N-able N-central, to its KEV catalog on Monday after reports of active exploitation; the issue is incomplete patching for CVE-2026-18556 and is fixed in version 2026.3 HF1. Exploitation lets remote attackers gain administrative access to N-central servers and use the built-in Take Control feature to pivot into managed endpoints and deploy persistence, and N-able acknowledged a limited number of customers were compromised.
Key Takeaway: Huntress traced post-exploitation connections to Mullvad and NordVPN exit nodes, including 37.19.210[.]32, which was previously abused for bruteforcing and spam, and FCEB agencies have until August 6, 2026 to patch and review Take Control activity in their environments.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-8875CVE-2025-8876CVE-2026-18556CVE-2026-18577
- Related