N-able Releases Hotfix for N-central Security Vulnerability
Attackers gained access to managed systems and achieved persistence.
1N-able Addresses Security Vulnerability
N-able is investigating a security vulnerability discovered in its Remote Monitoring and Management (RMM) product, N-central. This vulnerability allowed attackers to gain access to managed systems and achieve persistence. The company is taking proactive measures against evolving attack techniques by threat actors.
2Importance of Hotfix 2
N-able has released Hotfix 2, which complements the previous hotfix. This patch includes additional protective measures and supersedes the earlier hotfix. The company strongly recommends that all customers apply Hotfix 2 to enhance the security of their systems.
3Discovery of the Attack
On July 31, 2026, N-able detected unusual activity in a customer's environment. This activity revealed that unknown threat actors were exploiting a zero-day vulnerability (CVE-2026-18577) in the N-central server. The vulnerability was rated with a CVSS score of 8.2.
4Origin of the Vulnerability
CVE-2026-18577 emerged as an incomplete fix for a previous vulnerability (CVE-2026-18556). Both vulnerabilities pose serious risks, including authentication bypass and account takeover. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that these vulnerabilities are actively being exploited.
5Attackers' Methodology
Attackers exploited the vulnerability in the N-central server to gain remote administrative access. They then used the Take Control feature to connect to managed systems. By registering a new Cloudflare Tunnel service, they ensured persistence even after their access to the N-central server was revoked.
6Affected Customers
N-able confirmed that a limited number of customers were affected by this attack. The company advises on-premise users to update their systems to version 026.3.1.10 immediately. Additionally, an expanded list of IP addresses was shared as indicators of compromise (IoCs).
7Automated Check Template
N-able released a custom service template that automatically checks for known IoCs on Windows device endpoints. The company emphasized that a clean result does not guarantee that the environment is unaffected. The investigation is ongoing, and additional indicators may be identified.
8Conclusion and Recommendations
N-able recommends that customers thoroughly review their environments, logs, and account activities. This attack underscores the importance of continuously updating cybersecurity measures. The company aims to stay prepared for future threats.
Original article: The Hacker News — N-able, N-central Güvenlik Açığına Karşı Hotfix Yayınladı