"This is not a duplicate of our previous communication," N-able warned.
Attack technique: CVE-2026-18577, Take Control, and Cloudflare Tunnel
N-able confirmed attackers exploited a critical N-central vulnerability tracked as CVE-2026-18577 to reach customer networks. According to the vendor, the flaw can give an unauthenticated attacker administrative access to the N-central remote monitoring and management platform. Exploitation of vulnerable on-premises N-central servers allowed attackers to use the platform's Take Control feature to launch remote-control sessions against managed endpoints.
Once inside managed environments, attackers registered a new Cloudflare Tunnel service to preserve access after they were removed from the N-central server — a persistence technique Huntress previously observed in the wild and which N-able's investigation corroborated. Huntress had described successful exploitation as granting "the same level of N-central access normally reserved for trusted network operations and engineering staff." N-able says the exploited servers were running versions prior to 2026.3.1.7.
N-able's mitigation timeline: Hotfix 1, Hotfix 2 (2026.3.1.10), and hosted mitigations
N-able first became aware of active exploitation on July 31 after its Adlumin managed detection and response service identified suspicious activity at a customer. The vendor disclosed CVE-2026-18577 and released an initial emergency hotfix on August 2. On August 7 N-able published a second mandatory hotfix — Hotfix 2, version 2026.3.1.10 — and instructed customers running N-central on-premises to install it immediately, explicitly telling organizations that Hotfix 2 "is required, even if you already applied the earlier hotfix."
The vendor says Hotfix 2 supersedes Hotfix 1 and "adds further hardening measures as it monitors threat actors and watches them 'evolve their attack techniques.'" N-able also reports that hosted N-central environments have already received the latest mitigations.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDisclosure actions: published IPs and hunting artifacts
N-able released 10 IP addresses it says were used in the attacks and provided a service template customers can use to hunt for known indicators of compromise on Windows endpoints. The company cautions that a clean scan with that tool is not a definitive all-clear, noting the template checks only for indicators identified so far and that more may emerge as the investigation continues.
When asked by The Register about the scope and effects of the intrusions — how many customers were affected, how many downstream systems attackers reached, or what attackers did after establishing persistence — N-able declined to provide those specifics, instead saying it is "proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques."
What this means for managed service providers, security teams, and CISA
- Managed service providers (MSPs) and affected customers: Immediate action is clear — install Hotfix 2 (2026.3.1.10) on on-premises N-central servers even if Hotfix 1 was applied. MSPs should also use the published IP list and service template to hunt for evidence of access, and treat a single clean scan as inconclusive given N-able's caveat that more indicators may surface.
- Security operations and incident responders: Expect to investigate lateral access via the Take Control feature and look for Cloudflare Tunnel registration as a persistence mechanism. The published IP addresses and service template provide starting points, but responders should assume additional indicators may not yet be known.
- CISA and federal IT teams: CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities catalog and gave U.S. federal agencies until August 6 to remediate — a three-day deadline tied to the urgent risk the agency associated with the bug. That compressed timeline placed rapid patching and mitigation at the center of the federal response.
Outcomes and outstanding questions
N-able says a "limited number" of customers were affected, but the company has not quantified that number, nor disclosed how many downstream systems attackers reached or what specific actions attackers took once persistent access was established. The vendor also has not said whether the second hotfix was prompted by attackers finding a way around the first emergency fix. Those gaps leave concrete scope and impact questions unanswered even as immediate mitigation steps are mandated.
For organizations that rely on N-central for centralized administration of customer systems, the practical reality is immediate and binary: apply Hotfix 2 for on‑premises deployments and confirm hosted instances received mitigations. Beyond that, investigators and administrators must sift through the indicators N-able has published while preparing for additional artifacts to emerge as the vendor continues its investigation.
