Summary
- N-able has confirmed attackers exploiting CVE-2026-18577 successfully reached customer networks through the N-central remote monitoring and management platform.
- Attackers used N-central’s Take Control feature to connect to managed endpoints, then registered Cloudflare Tunnel services to maintain persistence after ejection from the server.
- A second mandatory hotfix (version 2026.3.1.10) has been released and must be installed even by those who already applied the first fix from 2 August.
- N-able has published 10 attacker IP addresses and a Windows endpoint scanning template, but cautions that a clean result does not confirm a clean environment.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog with a three-day remediation deadline for US federal agencies.
Breach confirmed, scope still unclear
N-able has acknowledged that attackers exploiting CVE-2026-18577, a critical zero-day in its N-central platform, made it past the management server and into the networks of a ‘limited number’ of customers. Beyond that characterisation, the vendor has declined to specify how many customers were affected, how many downstream systems were reached, or what the attackers did once they had established a foothold. When pressed by The Register, N-able offered only a statement that it is ‘proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques.’
How the attack unfolded
The vulnerability allows an unauthenticated attacker to gain administrative access to N-central, effectively handing them the same platform privileges as trusted network operations and engineering staff. From there, attackers used N-central’s built-in Take Control feature to initiate remote sessions against managed endpoints — the customer systems the MSP was contracted to administer. To secure their position beyond the initial compromise, they registered a new Cloudflare Tunnel service on affected machines, a persistence mechanism that survives being removed from the N-central server itself. This behaviour was first observed and reported by Huntress; N-able’s own investigation has now corroborated it.
Why MSP platforms are high-value targets
N-central is used by managed service providers to administer large numbers of customer environments from a single pane of glass. That architecture is operationally efficient, but it also means a single compromised management instance can serve as a launchpad into dozens or hundreds of separate customer networks. Attackers are not targeting N-central to stay on the N-central server — they are using it as a transit point. The scale of potential downstream exposure is what makes this class of vulnerability particularly consequential for MSPs and their clients.
Detection began internally, response has been rapid
N-able became aware of the attacks on 31 July after its Adlumin managed detection and response service flagged suspicious activity at a customer. Investigation revealed an actively exploited zero-day. CVE-2026-18577 was disclosed and the first hotfix, version 2026.3.1.7, was released on 2 August. CISA added the bug to its Known Exploited Vulnerabilities catalog and gave US federal agencies until 6 August to remediate — a three-day window the agency reserves for vulnerabilities it considers an urgent risk.
A second hotfix is now mandatory
N-able has since released Hotfix 2, version 2026.3.1.10, and is requiring all on-premises N-central customers to install it immediately — including those who have already applied the first fix. The vendor was explicit: ‘This is not a duplicate of our previous communication. Hotfix 2 is required, even if you already applied the earlier hotfix.’ What specifically prompted the second round of hardening is not disclosed. N-able has not confirmed whether attackers found a way around Hotfix 1, nor have they clarified what additional attack techniques they observed that warranted the update. Hosted N-central environments have already received the latest mitigations from the vendor.
Indicators of compromise available, with caveats
N-able has published 10 IP addresses attributed to the attacks and released a service template that can be used to scan Windows endpoints for known indicators of compromise. However, the company is cautioning customers not to treat a clean scan as a clean bill of health. The tool checks only for indicators identified to date, and the vendor has stated that additional indicators may emerge as its investigation continues. That is a meaningful caveat for any MSP conducting post-incident assessment right now.
Why it matters
For CISOs at MSPs and organisations using managed services, this incident is a direct illustration of supply-chain risk at the management layer. An attacker who compromises an RMM platform does not need to breach each customer individually — the platform does the work for them. The Cloudflare Tunnel persistence technique is also significant: standard remediation steps that remove an attacker from the management server will not address persistent implants on managed endpoints. Any organisation whose MSP runs N-central on-premises should be demanding confirmation of Hotfix 2 installation, reviewing the published indicators, and treating a clean scan as inconclusive rather than definitive until the vendor’s investigation concludes.
What to do now
- If running N-central on-premises, install Hotfix 2 (version 2026.3.1.10) immediately, regardless of whether Hotfix 1 was already applied.
- Confirm with your MSP that they have installed Hotfix 2 if they run N-central to manage your environment.
- Use N-able’s published service template to scan Windows endpoints for known indicators of compromise, and check against the 10 attacker IP addresses N-able has released.
- Do not treat a clean indicator scan as confirmation of a clean environment — N-able has cautioned that additional indicators may emerge as its investigation continues.
- Hunt specifically for Cloudflare Tunnel services registered on managed endpoints that were not authorised by your organisation, as this was the persistence mechanism observed in these attacks.
- Monitor N-able’s security advisories for further updates, as the investigation is ongoing and the vendor has indicated threat actor techniques continue to evolve.
