N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete

Attackers exploited two authentication bypass vulnerabilities (CVE-2026-18556 and CVE-2026-18577, both scored 8.2 on CVSS 4.0) in N-able N-central, a remote monitoring and management (RMM) platform used by MSPs and IT teams. The first vulnerability, CVE-2026-18556 (CWE-288: authentication bypass through alternate path or channel), allowed unauthenticated administrative account takeover on N-central releases through 2026.1. N-able patched this in 2026.2, but attackers found an alternative exploitation path not blocked by that fix. This led to CVE-2026-18577 covering all builds prior to 2026.3.1.7. After gaining remote administrative access to N-central servers, attackers used N-able's built-in Take Control feature to reach managed customer endpoints. They then registered Cloudflare tunnels (cloudflared) as persistent Windows services on compromised endpoints. These tunnels connect outbound to Cloudflare's edge, requiring no inbound firewall rules or open listening ports. Running them as services ensures persistence across reboots. This allowed attackers to maintain access to endpoints even after the N-central server route was revoked. N-able detected the attack on July 31 after an unusual volume of licensing errors from on-premises customers and found attackers had compromised servers running 2026.1 and earlier. Huntress observed exploitation at one partner organization affecting nine downstream customer organizations, with attackers reaching one endpoint per organization and enumerating running processes before disconnecting. Attacker IPs were identified as Mullvad or NordVPN exit nodes.