N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist

N-able has released a second mandatory hotfix for its N-central remote monitoring and management (RMM) platform after threat actors exploiting a pair of authentication bypass vulnerabilities pivoted through compromised N-central servers to reach managed customer endpoints and deploy persistent backdoors. Both CVEs are now listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

The critical finding from ongoing incident response work: patching N-central is not enough. Attackers have already moved to managed endpoints and installed persistent Cloudflare tunnels there — footholds that remain active even after the N-central server is fully patched.

The Vulnerability Chain

Two CVEs underpin the active exploitation campaign:

CVE-2026-18556 — An unauthenticated administrative account takeover vulnerability in N-central, classified as CWE-288 (Authentication Bypass Using an Alternate Path). An unauthenticated remote attacker can gain full administrative access to an N-central server without valid credentials. CVSS v3.1: 8.1 High, CVSS v4.0: 8.2 High.

CVE-2026-18577 — An incomplete patch for CVE-2026-18556. After N-able released an initial fix, researchers discovered a residual authentication bypass path that was not addressed. This second CVE covers that bypass and affects all builds prior to the hotfix releases. Same CVSS scores (8.1/8.2 High).

Both vulnerabilities affect N-central on-premises installations. Cloud-hosted N-central instances were mitigated by N-able directly and do not require customer action.

The Attack Chain: From N-central Admin to Persistent Endpoint Access

Once attackers gained unauthenticated admin access to an N-central server, they used the platform's built-in Take Control feature — which provides remote desktop access to all managed endpoints — to pivot to downstream customer systems. From there, observed post-exploitation activity included:

1. Deploying Cloudflare tunnels (cloudflared.exe) registered as Windows services on managed endpoints. In some cases, the service was disguised under a legitimate-sounding name such as conhost.exe to avoid detection.
2. Disabling endpoint detection and response (EDR) tools using a vulnerable driver (bootrepair.sys / p.sys) via a bring-your-own-vulnerable-driver (BYVD) technique.
3. Exfiltrating data using Rclone, a legitimate cloud sync tool frequently abused for data theft.
4. Deploying ransomware on compromised endpoints after achieving persistent access.

The Cloudflare tunnel persistence is particularly concerning. Because these are registered as Windows services and route traffic through Cloudflare's network over standard HTTPS, they are difficult to detect with traditional network monitoring and survive reboots. Removing N-central's access to the affected endpoint does not remove the tunnel.

Hotfix 2 Is Mandatory

N-able released Hotfix 1 (build 2026.3.1.7) as an initial mitigation for CVE-2026-18577. However, Hotfix 1 was found to be insufficient. Hotfix 2 (build 2026.3.1.10), released on August 6, 2026, provides the full mitigation and is mandatory for all on-premises N-central deployments — including those that have already applied Hotfix 1.

CISA added both CVEs to the KEV catalog on August 3, 2026 and gave federal agencies a 3-day deadline to patch — one of the shortest KEV timelines issued this year. At the time of Huntress's disclosure, approximately 55.6% of monitored cloud N-central servers remained unpatched.

Remediation Steps

Step 1: Patch N-central Immediately

Upgrade all on-premises N-central installations to build 2026.3.1.10 (Hotfix 2). If you are running any version prior to this — including Hotfix 1 — apply the update now.

Cloud-hosted N-central instances were patched by N-able directly.

Step 2: Hunt for Endpoint Persistence (Critical)

Do not assume your managed endpoints are clean after patching N-central. Perform a thorough threat hunt on all endpoints managed by N-central for:

Cloudflare tunnels:

# Check for cloudflared.exe or disguised variants registered as services
Get-Service | Where-Object { $_.BinaryPathName -like "*cloudflared*" }
 
# Check running processes
Get-Process | Where-Object { $_.Name -like "*cloudflared*" -or $_.MainModule.FileName -like "*cloudflared*" }
 
# Check scheduled tasks
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*cloudflared*" }

Suspicious services registered from unusual paths:

Get-WmiObject Win32_Service | Select-Object Name, DisplayName, PathName | Where-Object { 
    $_.PathName -notlike "*System32*" -and $_.PathName -notlike "*Program Files*" 
}

Vulnerable driver presence:

# Check for bootrepair.sys or p.sys
Get-ChildItem -Path C:\ -Filter "bootrepair.sys" -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\ -Filter "p.sys" -Recurse -ErrorAction SilentlyContinue

Step 3: Review N-central Audit Logs

If your N-central server was accessible during the exploitation window (before Hotfix 2), review admin session logs for:

• Unexpected administrator account creation or privilege escalation
• Use of Take Control on endpoints during off-hours
• Mass deployment of scripts or binaries to managed endpoints

Impact on the MSP Ecosystem

N-central is deployed extensively by managed service providers (MSPs) and managed security service providers (MSSPs) to remotely manage client infrastructure. A compromised N-central instance does not just affect the MSP itself — it provides a pivot point to every client endpoint under management.

This attack pattern mirrors earlier campaigns targeting MSP platforms, including the Kaseya VSA incident in 2021. RMM platforms represent high-value targets precisely because they hold the keys to entire client portfolios.

MSPs using N-central should proactively notify affected clients that a security incident may have occurred, even if no evidence of compromise is yet confirmed, and conduct endpoint threat hunts across the full managed device fleet.

Timeline

References

• N-able Security Advisory — August 6, 2026
• CISA KEV Catalog
• Huntress Blog: N-able Vulnerability Exploitation
• Horizon3.ai: CVE-2026-18556 / CVE-2026-18577