N-able disclosed on August 1, 2026 that attackers exploited an authentication bypass vulnerability in its N-central remote monitoring and management (RMM) platform, gaining administrative access to at least one on-premises N-central server and using it as a springboard into the managed endpoints it controls. RMM platforms sit at the top of a trust hierarchy by design — a single compromised server can touch every endpoint it manages — which makes this class of bug disproportionately dangerous regardless of how many customers are directly affected.

What happened

The flaw, tracked as CVE-2026-18556, is an authentication bypass “using an alternate path or channel” affecting self-hosted N-central instances running version 2026.1 and earlier. An attacker was able to reach an administrative code path without going through the platform’s normal authentication flow, giving them the same level of access a legitimate N-central administrator would have — no credentials, no phishing, no prior foothold required beyond network access to the server.

Once inside, the attacker didn’t stop at the management console. They used N-central’s built-in Take Control feature — the same remote-access tooling MSPs use to jump onto managed customer machines for support — to connect directly to endpoints inside the managed environment. On those endpoints, the attacker registered a new local service that stood up a Cloudflare Tunnel, giving them an independent, outbound-only channel back into the environment that survives even after the compromised N-central server itself is remediated or access is revoked.

N-able says the incident affects “a limited number” of customers and that its support team has directly engaged with those affected. The company has not disclosed how the initial authentication bypass was performed technically, beyond confirming it does not require valid credentials.

Technical details

  • CVE: CVE-2026-18556 — authentication bypass via alternate path/channel
  • Affected: N-able N-central, self-hosted deployments on version 2026.1 and below
  • Fixed in: 2026.3 (N-able is urging all customers not on the latest build to upgrade immediately)
  • Post-exploitation tradecraft:
    • Abuse of the built-in Take Control remote-access feature to pivot from the N-central server into managed endpoints
    • Registration of a new local service on compromised endpoints to launch a Cloudflare Tunnel, establishing outbound persistence that bypasses inbound firewall rules and survives credential rotation or N-central server remediation
  • Known indicators: N-able has published four IP addresses associated with the activity — 173.249.252.200, 87.249.138.34, 37.19.210.32, and 68.235.46.214 — and says additional IOCs will follow as the investigation continues

This is the second time in roughly a year that N-central has landed on CISA’s Known Exploited Vulnerabilities catalog; two other N-central flaws were added in August 2025. RMM platforms have become a recurring target precisely because of the multiplier effect: compromising one MSP’s management server can expose every downstream client tenant it administers, echoing the blast radius seen in prior RMM and IT-management-tool incidents (SolarWinds Orion, Kaseya VSA).

Impact

Anyone running an affected self-hosted N-central instance should treat this as a confirmed-active incident, not a theoretical risk. The use of Take Control to reach managed endpoints means the blast radius isn’t limited to the N-central server itself — it potentially extends to every device the platform administers, including endpoints belonging to downstream customers if the N-central instance belongs to an MSP. The Cloudflare Tunnel persistence mechanism is particularly concerning: because the tunnel is attacker-initiated and outbound-only, it won’t show up in traditional inbound-firewall monitoring and will keep working even after the original entry point is closed.

Mitigation

  • Upgrade immediately to N-central 2026.3 or later; do not wait for a routine maintenance window given confirmed in-the-wild exploitation.
  • Hunt for the published IOCs in N-central server logs and endpoint network telemetry: 173.249.252.200, 87.249.138.34, 37.19.210.32, 68.235.46.214.
  • Audit Take Control session history on your N-central instance for connections you cannot attribute to legitimate technicians, especially sessions initiated outside normal support hours or from unrecognized source IPs.
  • Inventory local services on every managed endpoint for unauthorized Cloudflare Tunnel (cloudflared) installations or any newly registered service you didn’t provision — this is the persistence mechanism observed and it will outlive an N-central-only remediation.
  • Restrict outbound access from managed endpoints to only the destinations required for legitimate RMM traffic where feasible; unexpected outbound connections to *.trycloudflare.com or Cloudflare’s tunnel infrastructure from endpoints that shouldn’t need it are a strong detection signal.
  • If you are an MSP, notify downstream clients whose endpoints were reachable via Take Control during the exposure window, even if N-able has not flagged your tenant directly — the pivot happened at the endpoint level, not just the console level.

Sources: N-able Security Update, August 1, 2026, N-able Status — Security Notices, OffSeq Threat Radar — CVE-2026-18556.