N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete
Summary: N-able disclosed that attackers exploited an authentication bypass, CVE-2026-18577, in N-central to gain remote administrative access and reach customer systems managed through those servers, after its first fix for CVE-2026-18556 proved incomplete. N-able shipped build 2026.3.1.7 on August 2 as the first unaffected version, and said attackers used Take Control to reach managed endpoints and registered Cloudflare tunnels as services that survived a reboot and preserved access after the route through the N-central server was revoked.
What's compelling: Huntress reported the activity reached nine organisations under a single partner account, one endpoint each, and N-able has not disclosed how many customers were affected, how many downstream devices were reached, or whether any data was taken - while upgrading N-central does not remove tunnel persistence already installed on another machine.