N-able Issues Emergency N-central Hotfix 2 Amid Active Tunneling Attacks

Threat actors are actively leveraging an authentication bypass vulnerability in N-able N-central, prompting the vendor to issue Hotfix 2 after discovering that an initial patch failed to fully mitigate the threat. Tracked as CVE-2026-18577 (CVSS score 8.2), the security flaw stems from an incomplete fix for a previously disclosed flaw, CVE-2026-18556 (also CVSS 8.2). Attackers exploiting this N-able N-central vulnerability can bypass authentication mechanisms on vulnerable servers and achieve administrative account takeover.

N-able first detected suspicious activity within a customer’s environment on July 31, 2026, which led to the discovery of the zero-day flaw in the N-central server architecture. Subsequent investigation revealed that threat actors were actively abusing the vulnerability to breach N-central instances running versions prior to 2026.3.1.7. Because both CVE-2026-18577 and CVE-2026-18556 allow unauthorized remote administrative access to central management servers, both flaws have been flagged as actively exploited by the Cybersecurity and Infrastructure Security Agency (CISA).

Despite the release of an initial hotfix, N-able’s ongoing monitoring identified evolving threat actor techniques that bypassed early protections. In response, N-able released Hotfix 2, emphasizing that it is required for all on-premise installations—even those that previously applied Hotfix 1. On-premise instances must be updated to version 2026.3.1.10 to be properly secured against active exploitation.

How the Attack Works: From Server Takeover to Endpoint Persistence

The attack chain observed in these incidents underscores the severe risk posed by compromised Remote Monitoring and Management (RMM) platforms. Once an attacker leverages CVE-2026-18577 to gain administrative rights on the N-central server, they immediately gain command over the management controls linked to managed endpoints.

Rather than relying purely on noisy script deployment, the threat actors leveraged N-central’s native “Take Control” remote assistance feature. This feature allows administrators to initiate direct remote desktop sessions to systems within the managed environment. By relying on legitimate administrative tooling already trusted by endpoint security controls, the attackers were able to move laterally onto managed Windows devices without raising immediate endpoint detection alerts.

After gaining access to target endpoints, the attackers took explicit steps to ensure long-term persistence that would survive server-level remediation. On compromised Windows machines, the actors registered a new Windows service configured to run a Cloudflare Tunnel (cloudflared).

Cloudflare Tunnels work by establishing outbound HTTPS and WebSocket connections from the client machine to Cloudflare’s global edge network. Because these outbound connections use standard port 443 and encrypt traffic, they easily pass through restrictive firewalls and NAT configurations without requiring inbound listening ports. By establishing this reverse tunnel, the threat actors maintained an out-of-band remote access route directly to the client endpoint. Consequently, even if an administrator revokes the attacker’s administrative access on the N-central server or shuts the server down entirely, the threat actors retain persistent, encrypted remote access to the compromised endpoints.

The Blast Radius of Compromised RMM Platforms

Remote Monitoring and Management tools like N-central occupy a uniquely trusted position in enterprise and Managed Service Provider (MSP) infrastructure. RMM platforms run lightweight agent software with high privileges (often SYSTEM on Windows) across thousands of downstream machines, allowing administrators to push updates, execute scripts, and troubleshoot issues centrally.

When an adversary achieves an authentication bypass on an RMM server:

• Implicit Trust Abuse: Downstream agents treat instructions from the central server as authorized administrative actions. Perimeter controls and local host firewalls offer no protection against actions initiated through established RMM channels.
• Multi-Tenant Exposure: For MSPs, a single compromised RMM server provides an attacker with a launching pad into dozens or hundreds of distinct client organizations simultaneously.
• Out-of-Band Persistence Risks: By pivoting from the central management platform to establish independent persistence mechanisms like Cloudflare Tunnels on individual endpoints, the blast radius shifts from a server-level incident to a multi-endpoint incident requiring comprehensive endpoint hunting across the entire estate.

While N-able confirmed that a limited number of customers have been impacted so far, any organization running an unpatched, exposed N-central server must assume that downstream endpoints could be compromised.

What To Do

Organizations running on-premise N-able N-central instances must take immediate action to patch their servers and inspect their managed endpoints for indicators of compromise.

1. Apply Hotfix 2 Immediately: Update all on-premise N-central installations to version 2026.3.1.10 (Hotfix 2) immediately. Hotfix 2 supersedes Hotfix 1 and introduces crucial additional hardening measures. Applying Hotfix 1 alone is insufficient.
2. Run Endpoint Scans via N-able Custom Template: Deploy N-able’s newly released custom service template across all Windows endpoints. This template automates checks for known indicators of compromise associated with this campaign. Note that a clean template result should not be treated as a definitive guarantee of non-compromise; it should serve as one component of a broader investigation.
3. Hunt for Persistence and Unrecognized Services: Inspect Windows endpoints for newly created or suspicious Windows services associated with cloudflared.exe or unrecognized Cloudflare Tunnel configurations. Review network telemetry for anomalous outbound connections to Cloudflare edge infrastructure, and audit N-central administrative log history from July 31, 2026 onward for unauthorized account creations or unprompted usage of the “Take Control” remote session feature.