N-able warns of N-central auth bypass flaw exploited in attacks
N-able patches N-central auth bypass (CVE-2026-18577) under active exploitation
N-able released hotfix 2026.3.1.7 on August 2, 2026 to address CVE-2026-18577, an authentication bypass vulnerability affecting all N-central versions before 2026.3. The flaw, which allows administrative account takeover, is being actively exploited in the wild and represents an incomplete patch for the earlier CVE-2026-18576. Because N-central is a widely-used RMM platform for MSPs and enterprise IT, compromises can cascade to downstream customers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run N-able?
Get an email when a new story names N-able, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2026-18577 is an authentication bypass vulnerability in N-able's N-central RMM platform that allows attackers to take over administrative accounts without valid credentials. The flaw is particularly dangerous because it represents an incomplete fix for a prior vulnerability (CVE-2026-18576), meaning organizations that believed they had patched the original issue remained exposed. Because N-central is used by Managed Service Providers (MSPs) to manage downstream customer environments, a single compromised instance can propagate attacks across dozens or hundreds of organizations. This illustrates the compounding risk of supply-chain-adjacent tools where one platform breach becomes a force multiplier for threat actors. Prompt application of hotfix 2026.3.1.7 is critical, but organizations must also audit for signs of prior compromise before assuming they are clean.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-18577
- cve — CVE-2026-18576
- malware — Cloudflared (abuse)