N-Able's First Patch Didn't Patch — CVE-2026-18577 Turns Every N-central Customer Into a Foothold

One tool, every customer's network

N-central is the console MSPs use to manage hundreds of client networks from one screen — patching, monitoring, and, critically, a built-in remote-access feature called Take Control. That design is exactly why an authentication bypass in N-central isn't a single-tenant incident. In the last week of July and first week of August 2026, N-able shipped a patch for one authentication-bypass bug, discovered days later that the patch didn't actually close it, and shipped a second emergency hotfix while CISA ran a 3-day federal deadline clock in the background.

The patch that didn't patch

These are two separate CVE records describing the same failure mode twice. CVE-2026-18556 is an authentication-bypass-using-an-alternate-path-or-channel flaw (CWE-288) affecting N-central through version 2026.1, CVSS 7.4. CVE-2026-18577 is N-able's own description of what happened next: "an incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1." Same bug class, same CWE-288, higher score (8.1) because the second bypass path was easier to reach (AC:H stayed, but the practical exploitation path attackers used required no special conditions).

The timeline: exploited before the first patch even shipped

What attackers actually did with it

Per N-able's own incident notes and reporting from Huntress and The Hacker News, the abuse pattern after gaining admin access on an N-central server was consistent: attackers connected using MSP Support, a default username tied to legitimate N-central Take Control sessions, then used Take Control itself to pivot into managed customer endpoints — no separate exploit needed once inside, because Take Control is a first-class, trusted feature of the product. On endpoints, they registered a service named Cloudflared (the real, legitimate Cloudflare tunneling binary, repurposed as a covert outbound channel) and, per N-able's incident guidance, investigators are told to check user documents folders for a planted file named svchost.exe — living-off-the-land naming meant to blend into a Windows process list at a glance.

Not the first time — same product, almost the same week, one year apart

N-central has a KEV history. In August 2025, CISA added two other N-central flaws to the catalog: CVE-2025-8876, an OS command-injection bug (CVSS 8.8), and CVE-2025-8875, an insecure-deserialization bug (CVSS 7.8) — both published 2025-08-14, both affecting N-central before 2025.3.1, both exploited in what reporting at the time described as limited on-premises attacks. This year's pair landed within a day of each other, in the same first week of August, in the same product line. That's not proof of a pattern in the bug class — a command-injection RCE and an authentication-bypass chain are different failure modes — but it is a second consecutive year where N-central's on-prem deployment was a live KEV entry in early August, which is worth an MSP's attention independent of any single CVE.

What to actually do

1. Confirm you are on build 2026.3.1.10 (Hotfix 2) — not just 2026.3.1.7 (Hotfix 1), which N-able itself says was incomplete.
2. Check the 4 published IOC addresses (173.249.252[.]200, 87.249.138[.]34, 37.19.210[.]32, 68.235.46[.]214) against your N-central server's access and firewall logs.
3. Search endpoints managed through N-central for a service named "Cloudflared" that you did not deploy, and for a file named svchost.exe sitting in a user's Documents folder rather than System32.
4. Audit Take Control session history for connections under the "MSP Support" account you did not initiate.
5. Treat a clean scan as inconclusive, not clearance — N-able's own guidance says as much. If Take Control access was live during the exposure window, assume every endpoint reached through it needs its own review.

Vulnerability data as of 2026-08-08live record →