N-able shipped a patch for an authentication-bypass vulnerability in N-central, its remote monitoring and management (RMM) platform, and reasonably considered it closed. It wasn’t. Attackers found a second route to the same outcome — full administrative account takeover — and by early August were actively exploiting it against production servers.
What happened
The original bug, CVE-2026-18556, let an attacker bypass authentication on N-central. N-able patched it in version 2026.2. What the fix didn’t account for was an alternate path to the same authentication bypass — assigned its own identifier, CVE-2026-18577, and affecting every N-central build prior to 2026.3.1.7.
N-able first noticed something was off on July 31, when licensing anomalies started showing up on customer servers — an odd but telling symptom of unauthorized admin accounts being created. By August 2, the company had confirmed active exploitation and pushed 2026.3.1.7 as the real fix. Cloud-hosted customers got it automatically; on-premises deployments needed to patch themselves, which means a population of exposed servers almost certainly still exists.
How the bypass worked
Once an attacker has admin access to N-central, they aren’t just looking at one company’s helpdesk tooling — they’re looking at the control plane MSPs use to manage every endpoint across every client they serve. Reporting on the exploitation describes attackers using N-central’s own built-in “Take Control” feature to pivot from the compromised management server into managed endpoints, then deploying Cloudflare-based tunnels to hold that access.
That detail matters: the attackers didn’t need to bring their own remote-access tooling or write custom malware to move laterally. N-central’s legitimate remote-control functionality did that work for them, and a Cloudflare tunnel is difficult to distinguish from ordinary encrypted traffic on many networks. The platform’s core value proposition — centralized control over many downstream environments — became the attacker’s lateral movement primitive, for free.
Why it matters beyond one product
This is a rerun of a pattern the industry has seen before with RMM software (Kaseya’s 2021 incident being the reference point), and the mechanics explain why it keeps recurring:
- The blast radius is structural, not incidental. An RMM platform exists specifically to have privileged reach into many downstream networks. Compromise the platform and you inherit that reach — no additional exploitation needed per victim.
- A patch bypass is a harder problem than an unpatched CVE. The first fix genuinely closed the reported vulnerability; the underlying design still permitted an equivalent outcome through a different path. Verifying that a fix eliminates a class of bug, not just the one reported instance, is the harder and less-tested part of vendor patch review.
- Detection signals were operational, not security-native. The earliest indicator N-able saw was licensing weirdness — a billing-adjacent symptom, not an alert from a security control. That’s a difficult signal for a downstream customer to have any visibility into at all.
What it means for defenders
If your organization uses N-central, whether directly or because an MSP manages your environment with it, the immediate action is confirming the platform is on 2026.3.1.7 or later — and if you’re the customer of an MSP, that’s a question worth asking them directly rather than assuming.
More durably, this incident argues for treating RMM and other centralized-management platforms as tier-0 infrastructure in your own risk model, regardless of who operates them:
- Ask MSPs and internal tooling owners what monitoring exists on the management plane itself, not just on the endpoints it controls — anomalous admin account creation and unexpected use of built-in remote-control features are the signals that would have caught this early.
- Watch for Cloudflare (and similar) tunnel traffic originating from management infrastructure that has no legitimate reason to initiate outbound tunnels — a narrow, high-signal detection that doesn’t require deep platform-specific tooling.
- When a vendor patches an auth-bypass CVE, treat “patched” as provisional until there’s been time for exactly this kind of bypass-of-the-bypass to surface, especially for platforms with the reach an RMM tool has.
The vulnerability class here isn’t novel. What’s worth internalizing is how little additional work the attacker had to do once they were in — the platform did the hard part for them.
Further reading: BleepingComputer, The Hacker News, and Huntress’s analysis.