Reported by 4 outlets

Timeline

1. original reporting

   N-able N-central Critical Auth Bypass (CVE-2026-18556/18577) Actively Exploited — First Fix Was Incomplete; MSPs Urged to Hotfix Now

   huntress.com · 72d ago · August 3rd, 2026

   Missed by today's feeds; surfaced via external monitoring. N-able disclosed Aug 1–2 with confirmed in-the-wild exploitation.

   N-able disclosed a critical vulnerability in N-central, its flagship RMM platform used by MSPs to monitor and remotely administer every downstream customer endpoint. Key facts:

   • CVE-2026-18556 (initial advisory) → CVE-2026-18577 ("an incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central versions through 2026.3.1"). All currently supported versions are affected, including builds initially believed safe — both cloud-hosted and on-premises.

   • An unauthenticated attacker gains full administrative "god-mode" access to the RMM console — the same control level as trusted NOC/engineering staff. From there they can push scripts/jobs to managed endpoints, deploy dual-use tools via the N-able agent, and (per Huntress) abuse the built-in Take Control feature to pivot into managed endpoints and deploy Cloudflare-based tunnels for persistence.

   • N-able shipped hotfix 2026.3.1.7 on August 2 as the first unaffected build. Huntress reports 55.6% of reachable cloud N-central servers were still unpatched as of Aug 3, and notes the server runs a custom AlmaLinux 9 appliance that frequently has no EDR deployed.

   • IOCs: attacker traffic observed from 87.249.138[.]34 (NordVPN exit node), 37.19.210[.]32 (Mullvad exit node, previously abused for brute-forcing/spam), plus 37.153.90[.]88 and 92.118.112[.]181 (added by N-able in a follow-up advisory).

   Why it matters: This is the Kaseya-VSA-shaped nightmare for the MSP supply chain — RMM compromise means downstream access to every managed customer, and the incomplete-first-fix pattern means orgs that patched to the original advisory version are still exposed.

   Action: Apply 2026.3.1.7 immediately; if N-central is reachable from untrusted networks, consider taking it offline until patched behind strict network controls. Audit for suspicious logins, new remote-control/Take Control sessions, and unexpected Cloudflare tunnel processes on the N-central host. Hunt for the four IOCs.

2. update from bleepingcomputer.com

   N-able N-central Auth Bypass (CVE-2026-18577) Added to CISA KEV; Hotfix 2026.3.1.7 Rollout Underway

   bleepingcomputer.com · 71d ago · August 4th, 2026

   New today: CISA added CVE-2026-18577 to the KEV catalog (Aug 3, first KEV addition since Jul 29), and N-able confirms hotfix 2026.3.1.7 is the only unaffected build.*

   CISA formally added CVE-2026-18577 (N-able N-central authentication bypass using an alternate path/channel) to its Known Exploited Vulnerabilities catalog on August 3, binding FCEB agencies under BOD 26-04 to urgent remediation and pre-patch compromise checks — and confirming federal recognition of the in-the-wild exploitation N-able disclosed August 1. - N-able's Sunday hotfix 2026.3.1.7 addresses the flaw across all N-central versions before 2026.3; hosted deployments are already updated, on-premises customers must install manually. Action: Apply 2026.3.1.7 immediately (on-prem is manual — verify, don't assume). KEV listing means this should now be at the top of every vulnerability-management queue.

3. update from cyber.netsecops.io

   📰 N-able N-central Hit by Actively Exploited CVSS 10.0 RCE Flaw 🚨 URGENT: N-able N-central is being actively exploited via a CVSS 10.0 RCE z

   cyber.netsecops.io · 35d ago · September 8th, 2026

   📰 N-able N-central Hit by Actively Exploited CVSS 10.0 RCE Flaw 🚨 URGENT: N-able N-central is being actively exploited via a CVSS 10.0 RCE z

   via Mastodon https://cyber.netsecops.io/articles/n-able-n-central-critical-rce-zero-day-cve-2026-86218-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

4. update from meterpreter.org

   N-able releases N-central Hotfix 4 to address a critical zero-day vulnerability. Learn how to protect your server from remote code execution

   meterpreter.org · 34d ago · September 9th, 2026

   Learn how to protect your server from remote code execution

   via Mastodon https://meterpreter.org/n-central-zero-day-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social