N-able Releases Emergency N-central Hotfix Following Active Exploitation Investigation

N-able Issues Emergency Security Update for N-central Following Active Exploitation

N-able has released an emergency security update for its on-premises N-central Remote Monitoring and Management (RMM) platform after discovering a new method attackers could use to exploit a previously addressed vulnerability.

In a security advisory published on August 3, 2026, the company said its ongoing investigation into customer incidents uncovered an additional attack vector that was not mitigated by an earlier fix. The discovery prompted the release of a hotfix for N-central 2026.3, bringing the recommended version to 2026.3.1.7.

According to N-able, the vulnerability affects N-central servers running versions earlier than 2026.3.1.7 and allows attackers to obtain remote administrative access. Following successful exploitation, attackers used legitimate platform functionality to access managed devices and established persistence through Cloudflare Tunnel services.

The company stated that only a limited number of customers have been confirmed as affected and that its support teams are working directly with impacted organizations.

The advisory also introduces a new vulnerability identifier, CVE-2026-18577, while explaining that the issue was uncovered during additional analysis of an earlier vulnerability, CVE-2026-18556, which had already been addressed in N-central 2026.2.

Investigation Revealed an Additional Exploitation Method

According to N-able, the incident began on July 31, 2026, when engineering and security teams noticed an unusually high number of licensing-related issues affecting on-premises N-central customers.

Although licensing problems are not uncommon, the increased volume prompted a deeper investigation into the platform.

During that investigation, engineers re-examined CVE-2026-18556, a vulnerability that had previously been fixed in version 2026.2. Their analysis uncovered an alternative exploitation method that was not mitigated by the earlier fix.

To address the newly discovered attack path, N-able immediately developed and released a hotfix for N-central 2026.3. The company also assigned a new vulnerability identifier, CVE-2026-18577, to distinguish this separate exploitation method.

Customers are advised to upgrade directly to N-central 2026.3.1.7, which includes the latest protections against the newly identified attack vector.

Attackers Obtained Remote Administrative Access

N-able determined that attackers targeted N-central servers running versions earlier than 2026.3.1.7.

According to the company, successful exploitation allowed attackers to remotely obtain administrative access to vulnerable N-central servers.

After compromising the management server, the attackers leveraged Take Control, N-central's built-in remote access capability, to connect to systems managed through the affected deployment.

Rather than exploiting each managed endpoint individually, the attackers used legitimate platform functionality already trusted within customer environments to move into managed systems.

This illustrates how vulnerabilities affecting centralized management platforms can significantly increase operational risk, as compromising a single management server may provide administrative access to multiple downstream devices.

Cloudflare Tunnel Used to Maintain Persistence

Following access to managed endpoints, attackers reportedly registered a new service for a Cloudflare Tunnel.

According to N-able, this allowed attackers to maintain persistence even after administrators revoked access to the compromised N-central server.

Although the advisory does not provide technical details about how the tunnel was configured, it confirms that the persistence mechanism enabled continued access after the original management server connection had been removed.

The use of legitimate cloud-based tunneling services highlights how attackers increasingly combine trusted administrative tools with common networking technologies to remain inside compromised environments while reducing the likelihood of detection.

Technical Breakdown of the Attack

Based on information published by N-able, the attack targeted the centralized management layer rather than individual endpoints.

The reported attack sequence can be summarized as follows:

1. Exploit a vulnerable N-central server running a version earlier than 2026.3.1.7.

2. Obtain remote administrative access to the management server.

3. Use the built-in Take Control feature to access managed endpoints.

4. Register a Cloudflare Tunnel service on compromised systems.

5. Maintain persistent remote access after the N-central server is secured or disconnected.

The advisory does not describe the underlying vulnerability mechanics or disclose whether the initial compromise involved authentication bypass, privilege escalation, or another exploitation technique.

However, the reported sequence demonstrates why centralized management infrastructure should be treated as a high-value target. A successful compromise of an RMM platform can provide attackers with trusted administrative pathways into multiple managed devices, increasing the potential operational impact of a single vulnerability.

Enterprise Impact

The incident highlights the importance of securing Remote Monitoring and Management (RMM) platforms, which are widely used by managed service providers (MSPs) and enterprise IT teams to manage servers, workstations, network devices, and other endpoints from a centralized console.

According to N-able's advisory, the attackers targeted the N-central management server rather than individual endpoints. Once administrative access was obtained, they used the platform's legitimate Take Control capability to connect to systems within the managed environment.

This demonstrates how a compromise of centralized management infrastructure can provide attackers with trusted administrative pathways into multiple devices across an organization.

The advisory also illustrates another operational challenge. N-able reported that attackers established persistence by registering a Cloudflare Tunnel service after accessing managed endpoints. According to the company, this allowed continued access even after the compromised N-central server itself was no longer accessible.

Although N-able stated that only a limited number of customers have been affected, the incident reinforces the need to treat centralized management platforms as high-value assets that require continuous monitoring, timely patching, and strict administrative controls.

Limited Customer Impact Confirmed

N-able said that only a limited number of customers have been identified as impacted during the investigation.

For organizations confirmed to be affected, the company's support teams have initiated direct engagement to assist with response and remediation efforts.

The advisory does not disclose:

• The number of affected customers

• Industries involved

• Geographic distribution

• Whether customer data was accessed or exfiltrated

• Attribution to a specific threat actor

N-able also noted that its investigation remains ongoing and that additional technical information may be shared as it becomes available.

Published Indicators of Compromise

To help customers identify potentially affected environments, N-able published several IP addresses associated with the observed attack activity.

Organizations should review firewall, VPN, proxy, and endpoint logs for communications involving the following indicators:

• 173[.]249[.]252[.]200

• 87[.]249[.]138[.]34

• 37[.]19[.]210[.]32

• 37[.]153[.]90[.]88

• 92[.]118[.]112[.]181

• 68[.]235[.]46[.]214

N-able stated that additional indicators of compromise (IOCs) will be released if new findings emerge during the ongoing investigation.

Editorial Analysis

This incident reflects a broader security reality facing enterprise IT environments.

Remote Monitoring and Management platforms simplify software deployment, endpoint administration, patch management, and remote support by centralizing administrative capabilities. However, that same centralization also concentrates privileged access.

As a result, vulnerabilities affecting RMM platforms can have a much broader operational impact than vulnerabilities affecting individual endpoints.

In this case, attackers reportedly gained administrative access to vulnerable N-central servers and then leveraged legitimate platform functionality to move into managed systems before establishing persistence through Cloudflare Tunnel.

Although N-able has not suggested a widespread campaign, the advisory serves as a reminder that management infrastructure should receive the same level of protection as other critical enterprise systems.

Rapid patch deployment, restricted administrative privileges, and continuous monitoring remain essential defenses against attacks targeting centralized management platforms.

Immediate Security Recommendations

Based on its advisory, N-able recommends that customers take the following actions immediately:

• Upgrade to N-central 2026.3.1.7 if running an earlier version.

• Review environments for signs of unauthorized administrative activity.

• Monitor systems for the published indicators of compromise.

• Apply security updates promptly as they become available.

• Enforce multi-factor authentication (MFA) where supported.

• Regularly audit privileged user accounts and permissions.

• Monitor managed endpoints for suspicious activity.

• Continue following official N-able security advisories for additional updates.

For organizations already running supported versions, verifying that the latest hotfix has been successfully installed should be part of the incident response process.

Future Outlook

N-able stated that its investigation into the incident is ongoing and that additional indicators of compromise may be released as new information becomes available.

The advisory also demonstrates how continued security investigations can uncover previously unknown attack paths, even after an earlier vulnerability has been addressed.

In this case, additional analysis of CVE-2026-18556 resulted in the discovery of a separate exploitation method that has now been tracked as CVE-2026-18577.

Organizations using N-central should continue monitoring official N-able security communications while ensuring their deployments remain on the latest supported version.

The incident also highlights the importance of layered security practices, including timely patch management, strong identity controls, and proactive monitoring of privileged management systems.

Conclusion

N-able's latest security advisory confirms that attackers actively exploited a newly identified vulnerability affecting on-premises N-central deployments running versions earlier than 2026.3.1.7. The company responded by assigning CVE-2026-18577 and releasing an emergency hotfix to address the additional exploitation method discovered during its investigation.

Although only a limited number of customers have been confirmed as affected, organizations using N-central should upgrade immediately, review their environments for published indicators of compromise, and continue following official N-able advisories for further updates.

The incident highlights the importance of rapid patch management, continuous monitoring, and protecting centralized management platforms that provide privileged access across enterprise environments.