N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577
To help customers fend off ongoing attacks, N-able released a second security hotfix for N‑central, its monitoring and management (RMM) solution popular with managed service providers (MSPs).
“Hotfix 2 is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers,” the company said, and shared additional indicators of compromise observed in attacks.
A second hotfix to “expand protections”
Earlier this month, N‑able released N-central version 2026.3.1.7 (i.e., 2026.3 Hotfix 1), which patches an authentication bypass vulnerability (CVE-2026-18577) the company detected being exploited by attackers.
“On July 31, 2026, N‑able’s Adlumin MDR solution detected unusual activity within a customer’s environment, leading to the discovery of a threat actor actively exploiting a zero-day vulnerability in an N‑central server,” the company explained on Thursday.
CVE-2026-18577 was assigned to a patch bypass of the previously fixed CVE-2026-18556: a threat actor obviously found a variation that evades the previous patch’s specific checks and has been using it to compromise N-central instances and gain access to managed endpoints.
N-able did not say whether the threat actor found a way around the first hotfix, just that they are “proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques.”
“It is highly recommended that all partners upgrade to [N-central version 2026.3.1.10, i.e., 2026.3 Hotfix 2] ASAP,” the company said, and added that upgrading the agents on the managed devices is recommended (though not necessary) to protect customers from CVE-2026-18577.
Organizations using hosted N-central don’t have to update, as the hotfix has been applied already.
How the attackers operate post-exploitation
N-able says that once the threat actor exploits the vulnerability, they use the legitimate Take Control feature and connect to managed endpoints, where they register a new service for a CloudFlare tunnel for persistence.
The company first detected exploitation of CVE-2026-18577 on August 1, 2026, and shared a list of 6 IP addresses associated with the attacks.
Sophos says that the threat actor created a new domain account named “veeam” and reset the passwords of several existing domain administrator accounts, enumerated other existing accounts, installed additional remote-access tools, and disabled security software made by Microsoft and Sophos by leveraging an EDR-evasion tool.
The company expanded N-able’s initial list of indicators of compromise with four additional IP addresses and domain names of C2 and TacticalRMM servers.
Huntress researchers, after detecting exploitation on one of its customers’ N-central environments, shared additional insight into the actions performed by the threat actor.
According to them, the threat actor targeted key servers (typically Domain Controllers), enumerated process on a compromised system (before disconnecting), and later moved quickly across multiple hosts in impacted organizations’ environments.
“We are now seeing threat actors targeting the flaw across multiple organizations, though we are not yet seeing evidence that this has become a broad, indiscriminate campaign across our partner base,” they noted.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!