Attackers exploit N-able RMM auth bypass, and the first fix did not hold

N-able is warning that attackers exploited an authentication bypass in N-central, the remote monitoring and management platform used by managed service providers and IT teams to administer customer endpoints. The flaw, CVE-2026-18556, allows unauthenticated administrative account takeover, and N-able's initial fix in one release proved incomplete: it found another way to exploit the same weakness, tracked as CVE-2026-18577, that widened the affected range. After taking over a server, attackers used its remote-control feature to reach managed endpoints and installed Cloudflare tunnels as services, which kept access alive even after the route through the N-central server was cut. Build 2026.3.1.7 is the first unaffected version.

Check

Upgrade N-central to build 2026.3.1.7 immediately, then hunt managed endpoints for unexpected Cloudflare tunnel services and other persistence, since patching the server does not remove footholds already placed.

Affected

Managed service providers and IT teams running N-able N-central before build 2026.3.1.7 (CVE-2026-18556, CVE-2026-18577); an unauthenticated attacker can take over the server and pivot to every managed customer endpoint.

Fix

Apply the hotfix, review N-central and endpoint logs for unauthorized access and tunnel installs, revoke and rebuild trust where compromise is found, and restrict management platform exposure to the internet.