CISA adds N-able N-central account takeover flaw to KEV
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-18577, a high-severity N-able N-central vulnerability, to its Known Exploited Vulnerabilities catalog after reports of active attacks. The flaw carries a CVSS score of 8.2, and N-able has acknowledged that a limited number of customers were compromised.
CVE-2026-18577 affects susceptible N-central deployments and is fixed in version 2026.3 HF1. Federal Civilian Executive Branch agencies have been advised to apply the update by August 6, 2026, and review N-central Take Control activity in their environments.
Incomplete patch enables account takeover
The vulnerability is an incomplete fix for CVE-2026-18556, which also has a CVSS score of 8.2. CISA describes it as an authentication bypass through an alternate path or channel, allowing an attacker to bypass authentication and take over an N-central account.
Successful exploitation can give a remote attacker administrative access to a vulnerable N-central server. The attacker can then abuse the platform’s built-in Take Control feature to pivot into managed endpoints and deploy persistence mechanisms.
The incident also reflects attackers’ recurring use of borrowed trust, because access obtained through a legitimate remote management platform can make hostile activity resemble authorized administration while extending reach into customer systems.
Observed activity and compromise indicators
Huntress observed attackers targeting the flaw across multiple organizations, although there was no indication of a broad, indiscriminate campaign at the time of reporting. Post-exploitation activity included reconnaissance of important servers such as domain controllers, enumeration of running processes, and lateral movement to other hosts.
In at least one case, a malicious connection appeared through MSP Support, the default username associated with legitimate N-central Take Control sessions. The connection came from 173.249.252[.]200.
N-able recommended checking device users’ Documents folders for a file named svchost.exe and looking for a registered service called Cloudflared. Cloudflared is a legitimate Cloudflare tunnelling utility, but attackers frequently abuse it to create covert outbound connections and disguise malicious operations as legitimate traffic.
IP addresses named in the investigation
- 173.249.252[.]200
- 87.249.138[.]34
- 37.19.210[.]32
- 68.235.46[.]214
Huntress said all four addresses are Mullvad or NordVPN exit nodes. It observed substantial traffic from 87.249.138[.]34, attributed to NordVPN, and 37.19.210[.]32, attributed to Mullvad VPN. The latter had also been abused for brute-forcing, spam, and other malicious activity before this incident.
Immediate priorities for N-central operators
No known threat actor or group has been publicly linked to the campaign. The exploitation follows limited attacks against on-premises N-central environments involving CVE-2025-8875 and CVE-2025-8876 almost exactly one year earlier.
Organizations running N-central should move to version 2026.3 HF1, examine Take Control records, and investigate the listed file, service, addresses, and behavioural patterns. Because the platform manages remote endpoints, validation should extend beyond the N-central server to systems reached through administrative sessions, with particular attention to persistence and lateral movement.