N-central Vulnerability (CVE-2026-18577) Under Exploitation

THE THREAT

On August 2nd, 2026, N-able disclosed CVE-2026-18577, an authentication bypass vulnerability impacting N-central instances. The vulnerability is due to an incomplete patch that was released to address CVE-2026-18556 (CVSS: 7.4), another authentication bypass flaw which was disclosed on August 1st. Exploitation of CVE-2026-18577 (CVSS: 8.1) could result in attackers bypassing authentication and account takeover in N-central, granting full administrative access to an N-central console. A hotfix was released under version 2026.3.1 to address the flaw.

N-able confirmed that exploitation has been identified in a "limited number of customers". As exploitation is ongoing, organizations utilizing N-central within their environment must ensure that relevant patches are applied.

What we're doing about it

• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available
• eSentire customers can employ the Vulnerabilities and Inferred Vulnerabilities pages in Atlas Portal to search for potentially vulnerable assets
• eSentire's Threat Response Unit (TRU) is tracking this topic for additional information and detection opportunities
  • eSentire's TRU Team has performed threat hunts for known Indicators of Compromise (IOCs) across customer environments

What you should do about it

• After performing a business impact review, apply the relevant security patches
• Restrict access to the N-central console to trusted IP addresses and employ SSO where possible
• Review N-central logs for unusual logins, newly created administrative accounts, permission changes, or newly created or modified jobs

Additional information

N-central is a Remote Monitoring and Management (RMM) platform that is commonly used by Managed Service Providers (MSPs) to monitor, patch, and remotely access endpoints across their customer base. On August 1st, N-able disclosed CVE-2026-18556 following investigation into "an increase in licensing issues". This vulnerability was addressed in version 2026.2, which was later identified as incomplete, and leading to CVE-2026-18577. N-able notes that "a limited number of customers" were identified to have been impacted by the flaw, which allowed attackers to obtain remote administrative access, and registered services for a Cloudflare tunnel to enable persistence.

Following this disclosure, Huntress identified exploitation of CVE-2026-18577 "across multiple organizations" but did not have evidence at the time of publication to suggest that attacks were widespread. These attacks involved high-level reconnaissance to identify key targets, process enumeration, and lateral movement. Targeting widely used MSP tools underscores how threat actors can leverage trusted third-party management platforms to conduct large scale supply chain attacks, where the exploitation of this flaw could grant access to multiple downstream organizations.

CISA also added CVE-2026-18577 to its Known Exploited Vulnerabilities (KEV) catalog, giving Federal Civilian Executive Branch (FCEB) agencies a deadline of August 6th to ensure that relevant patches are applied. At the time of writing, Proof-of-Concept (PoC) exploit code has not been made publicly available for either CVE-2026-18556 or CVE-2026-18577; however, this can rapidly change. As exploitation is ongoing, organizations that utilize N-central within their environment should immediately apply the relevant hotfix.

References:
[1] https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/
[2] https://www.n-able.com/blog/n-central-security-update-august-2-2026
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-18556
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-18577
[5] https://www.huntress.com/blog/n-able-vulnerability-exploitation
[6] https://www.cisa.gov/news-events/alerts/2026/08/03/cisa-adds-one-known-exploited-vulnerability-catalog