Key Takeaways
- N‑able issued Hotfix 2 for N‑central, which supersedes Hotfix 1 and must be applied even if the earlier hotfix was already installed.
- The hotfix addresses CVE‑2026‑18577 (CVSS 8.2), an incomplete fix for CVE‑2026‑18556; both flaws enable authentication bypass and account takeover and are listed as actively exploited by CISA.
- Attackers used the vulnerability to gain remote administrative access, leveraged N‑central’s Take Control feature to reach managed devices, and installed a Cloudflare Tunnel service for persistence.
- Activity was first detected on July 31, 2026; a limited number of on‑premise customers have been affected.
- N‑able urges all on‑premise installations to upgrade immediately to version 2026.3.1.10.
- An expanded set of indicator‑of‑compromise (IoC) IP addresses has been published to help defenders spot malicious traffic.
- A custom service template is available for automated IoC checks on Windows endpoints, but a clean result does not guarantee safety; it should complement log reviews and account‑activity audits.
Overview of Hotfix Release and Rationale
On August 8, 2026, N‑able announced a fresh round of hotfixes for its Remote Monitoring and Management (RMM) platform, N‑central. The update, labelled Hotfix 2, is part of the company’s ongoing investigation into the exploitation of a recently disclosed security flaw. N‑able stressed that the new hotfix is not a duplicate of the previous communication; Hotfix 2 supersedes Hotfix 1 and must be applied even if the earlier hotfix had already been installed. The rationale behind this mandatory re‑application is the evolving tactics of threat actors, prompting N‑able to expand protections with additional hardening measures that go beyond the initial patch.
Details of the Vulnerabilities and CISA Involvement
The flaw targeted by Hotfix 2 is identified as CVE‑2026‑18577, carrying a CVSS score of 8.2. Researchers determined that CVE‑2026‑18577 stems from an incomplete fix for another vulnerability, CVE‑2026‑18556, which also carries a CVSS score of 8.2. Both vulnerabilities permit authentication bypass and subsequent account takeover in affected versions of N‑central (all releases prior to 2026.3.1.7). Because the weaknesses allow attackers to gain privileged access without valid credentials, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged them as actively exploited in the wild, urging organizations to prioritize remediation.
Attack Chain Observed by N‑able
In the incidents monitored by N‑able, attackers first exploited the authentication‑bypass vulnerability to obtain remote administrative access to the N‑central server. With admin privileges, they abused the platform’s Take Control feature—a legitimate tool designed for remote assistance—to pivot from the server to individual endpoints managed by N‑central. Once inside those devices, the threat actors registered a new service that establishes a Cloudflare Tunnel. This tunnel creates an encrypted, outbound connection to Cloudflare’s infrastructure, allowing the attackers to maintain persistence even if the original foothold on the N‑central server is later severed or the server is patched.
Impact Assessment and Remediation Guidance
N‑able confirmed that only a limited number of customers have been affected by the observed exploitation activity, though the exact count was not disclosed. The company emphasized that the risk is confined to on‑premise deployments of N‑central; cloud‑hosted instances are not impacted by this specific flaw. To mitigate the threat, N‑able advises all on‑premise customers to update immediately to version 2026.3.1.10 (the latest build that incorporates Hotfix 2). The update process should follow the standard patching procedures outlined in N‑able’s documentation, and administrators are encouraged to verify the successful installation of the hotfix via the product’s version‑information screen.
Indicators of Compromise (IoCs)
To assist defenders in detecting possible compromise, N‑able released an expanded list of IoC IP addresses associated with the malicious activity. Administrators should monitor network traffic for connections to or from the following addresses:
- 173.249.252.176
- 173.249.252.200
- 185.156.46.150
- 23.234.94.43
- 37.153.90.88
- 37.19.210.32
- 68.235.46.214
- 68.235.46.235
- 87.249.138.34
- 92.118.112.181
Presence of communication with any of these IPs warrants immediate investigation, including reviewing logs for anomalous admin sessions, unexpected service installations, or outbound TLS traffic to Cloudflare endpoints that deviate from normal baselines.
Detection Tool: Custom Service Template
In addition to the IoC list, N‑able has made available a custom service template that can be deployed within N‑central to automate checks for the known IoCs against Windows device endpoints. The template queries each managed workstation for signs of the malicious IP connections or the Cloudflare Tunnel service artifact. N‑able cautions, however, that a clean result from this template should not be interpreted as a guarantee that the environment is uncompromised. The agency notes that the investigation is ongoing, and additional indicators may emerge. Consequently, the template should be used as one layer of a broader assessment that includes thorough log analysis, account‑activity reviews, and verification of privileged‑access changes.
Ongoing Investigation and Future Guidance
N‑able reiterated that its security team continues to monitor threat‑actor behavior and to refine detection capabilities. The company promised to share further IoCs, updated hardening guidance, or additional hotfixes should new facets of the attack surface be discovered. Administrators are encouraged to stay subscribed to N‑able’s security advisories, to apply patches promptly, and to maintain a defense‑in‑depth strategy that combines timely updates, vigilant monitoring, and regular audits of privileged accounts. By treating the current hotfix as a baseline control rather than a final solution, organizations can better withstand the evolving tactics employed by adversaries targeting RMM platforms.