N-able has issued new hotfixes for its N-central Remote Monitoring and Management (RMM) platform in response to ongoing exploitation of a recently discovered security vulnerability. The company emphasized the necessity of applying Hotfix 2, even for those who have already implemented the previous update, as it includes additional security enhancements.
The issue came to light on July 31, 2026, when N-able identified unusual activity within a customer’s environment. This led to the discovery of attackers exploiting a zero-day vulnerability, designated as CVE-2026-18577 with a CVSS score of 8.2, affecting all N-central versions prior to 2026.3.1.7. Notably, this flaw is an incomplete fix for a prior vulnerability, CVE-2026-18556, which also allows authentication bypass and account takeover. Both vulnerabilities have been recognized by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as actively exploited threats.
In the observed attacks, perpetrators gained remote administrative access through the vulnerability and utilized N-central’s Take Control feature to connect to systems within the managed environment. After accessing these devices, they established a new service for a Cloudflare Tunnel, enabling persistent access even after their connection to the N-central server was severed.
N-able has confirmed that a limited number of customers have been affected by these incidents. Users operating on-premise versions are urged to update their systems to version 026.3.1.10 without delay. Additionally, the company has provided a list of IP addresses associated with the attacks as indicators of compromise (IoCs):
- 173.249.252[.]176
- 173.249.252[.]200
- 185.156.46[.]150
- 23.234.94[.]43
- 37.153.90[.]88
- 37.19.210[.]32
- 68.235.46[.]214
- 68.235.46[.]235
- 87.249.138[.]34
- 92.118.112[.]181
To assist customers in identifying potential compromises, N-able has released a custom service template that automates the process of checking Windows device endpoints in N-central for known IoCs. However, the company cautions that a clean result does not guarantee an unaffected environment and recommends a comprehensive review of logs and account activities.
This incident underscores the critical importance of timely patch management and vigilant monitoring within managed service environments. As attackers continue to evolve their techniques, organizations must remain proactive in applying security updates and conducting thorough assessments to safeguard their systems and data.
