Two days after N-able shipped a fix for an authentication bypass in its N-central RMM platform, the fix itself turned out to be bypassable. The new flaw, CVE-2026-18577, is described in its own CVE record as “an incomplete patch for CVE-2026-18556” — meaning every customer who upgraded to the version N-able recommended as the remediation was, until August 2, still exploitable. Huntress has confirmed exploitation of CVE-2026-18577 is ongoing.

What happened

N-able began investigating on July 31 after noticing an unusual volume of licensing errors coming from on-premises N-central customers — an odd signal that turned out to be a side effect of attackers probing the authentication flow. On the morning of August 2, N-able identified an alternate exploitation path that sidestepped the fix it had shipped for CVE-2026-18556 days earlier, and released an emergency hotfix, build 2026.3.1.7, that same afternoon.

The distinction from the original bug matters: CVE-2026-18556 was scoped to self-hosted N-central instances on version 2026.1 and earlier, with 2026.3 as the fix. CVE-2026-18577 affects all N-central builds through 2026.3.1 — meaning organizations that had already patched to the version N-able told them was safe were still exposed — and impacts both cloud-hosted and on-premises deployments, widening the blast radius considerably from the first advisory. Security researchers have described the resulting access as “god-mode”: full, unauthenticated administrative control of the RMM console, no credentials or prior foothold required.

Technical details

  • CVE: CVE-2026-18577 — authentication bypass via an incomplete patch for CVE-2026-18556
  • Affected: N-able N-central, all builds through 2026.3.1, both on-premises and cloud-hosted (2026.3.0 shipped July 30 was still vulnerable)
  • Fixed in: build 2026.3.1.7, released August 2, 2026 — this is the only safe build; upgrading to plain 2026.3 is not sufficient
  • Access gained: unauthenticated, full administrative (“god-mode”) access to the N-central management console
  • Post-exploitation tradecraft (consistent with the original CVE-2026-18556 activity): abuse of the built-in Take Control remote-access feature to pivot from the compromised N-central server into every managed endpoint it administers, followed by registration of a new local service on those endpoints to stand up a Cloudflare Tunnel — an attacker-controlled, outbound-only persistence channel that survives credential rotation and remediation of the N-central server itself
  • Once inside, attackers can run scripts, push tools, and open remote sessions across every downstream endpoint the platform manages — this is not limited to console access

Impact

N-central is built to sit at the top of an MSP’s trust hierarchy, which is exactly what makes an authentication bypass here disproportionately damaging: one compromised server administers every endpoint underneath it, potentially spanning many downstream client organizations that never interact with N-able directly. That the fix for the first bypass was itself bypassable compounds the risk — teams that patched promptly and considered themselves remediated were still fully exposed for the better part of two days, and may not realize a second update is required. This is the second N-central authentication bypass to see active exploitation inside a single week, and the platform has now landed on CISA’s KEV radar multiple times in the past year, reinforcing RMM software as a standing high-value target precisely because of its blast-radius multiplier — the same dynamic that made SolarWinds Orion and Kaseya VSA into mass-scale incidents.

Mitigation

  • Upgrade immediately to N-central build 2026.3.1.7 or later. If you upgraded to 2026.3 in response to the earlier CVE-2026-18556 advisory and stopped there, you are still exploitable — confirm your build number specifically, not just that you “patched.”
  • Assume compromise if you were on any pre-2026.3.1.7 build during the exposure window (through August 2) and hunt accordingly, rather than treating the update as sufficient on its own.
  • Audit Take Control session history for connections you cannot attribute to known technicians, particularly outside normal support windows or from unrecognized source IPs.
  • Inventory managed endpoints for unauthorized Cloudflare Tunnel (cloudflared) services — the persistence mechanism observed in the original campaign and consistent with this one — and for any newly registered service you did not provision.
  • Restrict outbound access from managed endpoints to what legitimate RMM traffic requires; unexpected outbound connections to Cloudflare tunnel infrastructure from endpoints that have no business making them is a strong detection signal.
  • MSPs should notify downstream clients whose endpoints were reachable via Take Control during the exposure window, even absent direct notification from N-able — compromise happened at the endpoint level, not just the console.

Sources: N-able Status — N-central 2026.3 Hotfix 1, Mitigation for CVE-2026-18577, N-able Security Update, August 2, 2026, Huntress — Critical N-able N-central Vulnerability and Active Exploitation, Help Net Security — Attackers exploit N-able N-central flaw to reach managed endpoints, NVD — CVE-2026-18577.