CISA Adds Exploited N-able N-central Flaw Enabling Remote Admin Takeover to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-18577, an actively exploited authentication bypass vulnerability in N-able N-central, to its Known Exploited Vulnerabilities (KEV) Catalog.

This vulnerability allows unauthenticated attackers to bypass authentication and potentially take over administrative accounts on vulnerable N-central servers.

CISA added this flaw to the KEV Catalog on August 3, 2026, and instructed Federal Civilian Executive Branch agencies to implement the vendor’s mitigations by August 6, 2026.

Although this deadline is binding for federal agencies, managed service providers (MSPs) and other N-central users should prioritize patching this issue urgently due to confirmed exploitation.

CISA Adds Exploited N-able N-central Flaw

The vulnerability, tracked as CVE-2026-18577, is classified as CWE-288, or Authentication Bypass Using an Alternate Path or Channel. N-able reported that this issue arose from an incomplete patch for CVE-2026-18556, a previously addressed security concern fixed in N-central version 2026.2.

During their investigation, N-able identified an alternative exploitation method that persisted after the initial remediation.

The company discovered that threat actors could target all N-central servers running versions prior to 2026.3.1.7, remotely obtain administrative access, and use the platform’s remote management capabilities to access managed customer environments.

On August 2, 2026, N-able released a hotfix for N-central version 2026.3 and urged customers to upgrade to version 2026.3.1.7 immediately.

N-able indicated that attackers exploited this flaw to gain remote administrative access to N-central servers and then leveraged the platform’s “Take Control” feature to connect to systems managed through the affected instance.

Once they accessed the endpoint systems, the attackers reportedly registered a new Cloudflare Tunnel service, which can provide persistent remote access even if defenders revoke access to the original N-central server.

N-able mentioned that it identified a limited number of impacted customers and has engaged directly with those organizations. The vendor’s investigation is ongoing, and additional indicators may be released as more evidence emerges.

Currently, CISA lists ransomware use as an unknown factor. However, compromising a Remote Monitoring and Management (RMM) platform poses significant risks, as it can grant attackers centralized access to numerous customer devices, privileged functions, and remote-control capabilities.

Known Indicators of Compromise

N-able has identified the following IP addresses associated with observed exploitation activity:

- 173.249.252.200
- 87.249.138.34
- 37.19.210.32
- 37.153.90.88
- 92.118.112.181
- 68.235.46.214

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

The vendor has also released a custom N-central service template designed to identify indicators of compromise on Windows endpoints. N-able cautioned that a clean result does not rule out compromise, as the tool only detects currently known indicators.

Organizations using N-able N-central should promptly upgrade vulnerable servers to version 2026.3.1.7 or later. Security teams should also review N-central administrative account activity, Take Control session logs, newly created Windows services, and outbound connections associated with Cloudflare Tunnel deployments.

Administrators are advised to investigate any unexpected remote management activity and assess endpoints managed by potentially affected N-central instances for persistence mechanisms, unauthorized accounts, and lateral movement.

CISA recommends following vendor instructions, evaluating internet exposure, and applying the agency’s risk-based security update guidance.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.