N-able Patches Vulnerability Exploited to Hack N-central Servers

N-able has patched a vulnerability in its N-central remote monitoring and management (RMM) platform that had been exploited in the wild after threat actors found a way to bypass the original fix, SecurityWeek reported on August 3. The vulnerability, tracked as CVE-2026-18577, allows remote code execution on N-central servers.

What the Vulnerability Does

CVE-2026-18577 is a pre-authentication remote code execution flaw in the N-central web interface. An attacker who can reach an N-central server over the internet can execute arbitrary code with the privileges of the N-central service account. N-central is used by managed service providers (MSPs) to monitor and manage customer endpoints, so a compromise can give an attacker visibility into hundreds or thousands of downstream networks.

"The N-central vulnerability CVE-2026-18577 has been exploited in the wild after threat actors found a patch bypass," SecurityWeek reported.

The Patch Bypass

N-able had originally patched the vulnerability in late July, but researchers quickly identified a bypass. Threat actors began exploiting the bypass within days. The new patch closes the bypass, and N-able is urging all customers to update immediately. The company has also published indicators of compromise and a detection script.

Why It Matters

RMM platforms are increasingly targeted because a single compromise can give attackers access to many downstream networks. Recent years have seen several major RMM-focused campaigns, including supply-chain attacks on Kaseya and ConnectWise. The N-able incident is another reminder that the MSP software supply chain is one of the most consequential attack surfaces in the security ecosystem.