N-able releases two patches for N-central authentication bypass vulnerability. N-able developers have released a second emergency patch for the N-central remote monitoring and management platform. The follow-up update was required due to ongoing attacks exploiting CVE-2026-18577: attackers are gaining administrator privileges on N-central servers and infiltrating customers' systems. N-able specialists first detected suspicious activity in one customer's environment on July 31, 2026. The subsequent investigation showed that unknown attackers had exploited a zero-day vulnerability in N-central, which was eventually assigned the identifier CVE-2026-18577 (CVSS score: 8.2). This vulnerability allows remote attackers to bypass authentication and take control of an administrator account. The issue turned out to be related to an improper fix for another bug - CVE-2026-18556, which also enabled authentication bypass and affected all N-central versions up to and including 2026.1. As a result, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, noting that they are being actively exploited by attackers. The first fix, included in N-central version 2026.3.1.7, was released on August 2. However, several days later, N-able issued a second emergency patch, included in version 2026.3.1.10. The company stressed that this update must be installed even by those who have already applied the previous patch, as the new fix includes additional protective measures. It turned out that after gaining administrative access to N-central via the zero-day flaw, the attackers used the built-in Take Control feature to connect to computers within managed environments. The attackers then configured a new Cloudflare Tunnel service on compromised systems, allowing them to retain remote access to victims' machines even after losing access to N-central. N-able representatives report that these attacks affected a "limited number" of customers, though the exact number of victims has not yet been disclosed. It is also unknown how many managed systems the attackers were able to access and what actions the hackers took after establishing persistence in those systems. The issue is compounded by the fact that the N-central platform is widely used by managed service providers (MSPs) and corporate IT departments to centrally manage large numbers of servers, workstations, and network devices. As a result, compromising N-central allows attackers to expand their attack and gain access to numerous client systems. Users of on-premises N-central installations are advised to upgrade to version 2026.3.1.10 immediately, while cloud instances have already been updated automatically. The investigation into the attacks is still ongoing, and N-able warns that the list of affected organizations and indicators of compromise will continue to grow.

N-able, a global cybersecurity company, reported second quarter 2026 results with total revenue of $138.2 million, representing 5.9% year-over-year growth. Subscription revenue reached $137.1 million, up 6.1% year-over-year. The company's total annual recurring revenue (ARR) stood at $544.5 million, growing 6.0% year-over-year. Non-GAAP net income was $18.7 million, or $0.10 per diluted share, whilst adjusted EBITDA reached $39.9 million, representing a 28.9% margin. N-able appointed Russell Rosa as Chief Revenue Officer to accelerate partner-led growth. The company also launched Shadow AI Visibility to help organisations govern AI usage and opened a Global Capability Centre in Bengaluru, India. For full-year 2026, management expects total ARR between $562-565 million and total revenue of $539-542 million, representing approximately 6-7% year-over-year growth.

N-able issues N-central Hotfix 2 as attackers reach managed systems and persist. Ravie LakshmananAug 08, 2026 Vulnerability / Enterprise Security N-able has released a fresh round of hotfixes for N-central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management (RMM) product. "We are proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques," the company said. "This is not a duplicate of our previous communication. Hotfix 2 is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers." The disclosure comes as N-able acknowledged that it detected unusual activity within a customer's environment on July 31, 2026, leading to the discovery of unknown threat actors exploiting a then-zero-day flaw in the N-central server (CVE-2026-18577, CVSS score: 8.2). It impacts all versions prior to 2026.3.1.7. It's worth noting that CVE-2026-18577 relates to an incomplete fix for CVE-2026-18556 (CVSS score: 8.2). Both vulnerabilities, which allow authentication bypass and account takeover in susceptible versions, have been flagged as actively exploited by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). In the attacks observed by N-able, the vulnerability allowed the attackers to obtain administrative access remotely and then leverage the Take Control feature to connect to systems within the N-central managed environment. Upon gaining access to those devices, the threat actors registered a new service for a Cloudflare Tunnel, enabling persistence even after access to the N-central server was revoked. N-able has confirmed that a limited number of customers have been affected by the exploitation activity. Customers running an on-premise version are advised to update their instances to 026.3.1.10 immediately. The company has also shared an expanded set of IP addresses as indicators of compromise (IoCs) - * 173.249.252[.]176 * 173.249.252[.]200 * 185.156.46[.]150 * 23.234.94[.]43 * 37.153.90[.]88 * 37.19.210[.]32 * 68.235.46[.]214 * 68.235.46[.]235 * 87.249.138[.]34 * 92.118.112[.]181 In addition, N-able has released a custom service template that offers an automated way to check for known IoCs against Windows device endpoints in N-central. "A clean result should not be interpreted as a guarantee that your environment has not been impacted," it said. "Our investigation is ongoing and additional indicators may be identified over time. We strongly recommend this be used as one layer of your assessment, alongside a thorough review of your environment, logs, and account activity." Found this article interesting? Follow ASMGi on Google News, Twitter and LinkedIn to read more exclusive content ASMGi post.