N-able has confirmed that a critical vulnerability in N-central, its flagship remote monitoring and management (RMM) platform, is being actively exploited in the wild, prompting an emergency hotfix and urgent calls for managed service providers (MSPs) to patch immediately.
The flaw, disclosed by N-able on 1–2 August, affects all currently supported versions of N-central, including the 2026.3 release line, across both cloud-hosted and on-premises deployments. According to security vendor Huntress, which published a rapid-response analysis of the incident, successful exploitation can hand an unauthenticated attacker administrative, “god-mode” access to the N-central console, the same level of control normally reserved for trusted engineering and NOC staff.
Tracking and Root Cause
N-able’s initial advisory linked the issue to CVE-2026-18556. A follow-up hotfix, however, was tied to a second identifier, CVE-2026-18577, whose description states that an incomplete patch for the earlier CVE left an authentication bypass and account takeover route open in N-central versions through 2026.3.1.
N-able released a hotfix, version 2026.3.1.7, on 2 August and is urging all customers to upgrade without delay. The vendor has not yet published full technical root-cause detail, and Huntress notes its own understanding of the attack chain may evolve as more information emerges.
How Attackers Are Using Access
Once inside a compromised N-central console, Huntress says attackers have been observed abusing the built-in Take Control feature to pivot from the RMM server into managed endpoints, including domain controllers, and deploying Cloudflare-based tunnels to maintain persistent access. The same access can be used to push new scripts and jobs across managed fleets, launch remote-control sessions, and alter security-relevant configuration such as accounts, roles and MFA settings.
Because a single N-central server can manage endpoints across many downstream client organisations, a compromise at the RMM layer effectively multiplies an attacker’s reach, a risk profile that has made RMM platforms a recurring target for threat actors targeting the MSP supply chain.
Huntress said it has so far identified exploitation affecting one organisation within its own customer base, and is continuing to hunt across its telemetry for related activity while prioritising partners running N-central for deeper log review and faster escalation.
Detection and Indicators
Huntress has published indicators of compromise, including four IP addresses and three hostnames linked to N-able’s own findings, and is advising defenders to search N-central access logs, firewalls, proxies and WAFs for any interaction with them. On Windows endpoints managed by N-central, the firm says suspicious Take Control sessions have left log artefacts under C:ProgramDataGetSupportService_N-CentralLogs, though it cautions that these files are also generated during legitimate support activity and should be corroborated against viewer IP, account identity and target-host sensitivity before being treated as evidence of compromise.
Recommended Actions
N-able and Huntress are urging N-central customers to apply the 2026.3.1.7 hotfix immediately, restrict console access via firewall rules or VPN rather than exposing it to the open internet, enforce multi-factor authentication on all accounts, and audit recent logins, account changes and automation jobs for anything unexplained. For organisations that cannot quickly reduce their exposure, Huntress suggests weighing whether to temporarily take N-central offline until the hotfix can be applied and the server brought back up behind stricter network controls.
Further guidance and release notes are available on N-able’s status and support pages. Huntress says it will continue to update its advisory as more detail on the vulnerability and its exploitation becomes available.
