N-able Orders N-central 2026.3.1.7 Upgrade After Incomplete Fix
N-able says attackers exploited an authentication bypass in its N-central remote monitoring and management platform to obtain remote administrative access and reach customer systems. The company now says every customer must run build 2026.3.1.7, released on August 2, because its initial remediation was incomplete.
The latest flaw, CVE-2026-18577, affects builds before 2026.3.1.7 and carries a CVSS 4.0 score of 8.2. N-able's earlier instruction to upgrade to N-central 2026.3 is no longer sufficient. Hosted NCOD instances will be upgraded automatically on a schedule shared directly with partners, while customers must update self-hosted servers themselves.
How the attackers retained access
After compromising an N-central server, the attackers used Take Control to access managed endpoints. They then registered Cloudflare tunnels as services on devices. Those tunnels connect outbound to Cloudflare's edge, avoiding the need for an inbound firewall rule or open listening port, while service registration allows them to survive a reboot.
N-able said this mechanism preserved access after the route through the N-central server was revoked. The disclosure does not indicate that Cloudflare itself was compromised; its tunnelling service was abused. This persistence pattern adds to the operational risks posed by critical zero-day flaws affecting industrial control systems because remediation must extend beyond the initially compromised management platform and into downstream systems.
N-able began investigating on July 31 after observing an unusual volume of licensing errors from on-premises customers. It found that an attacker had remotely obtained administrative access to servers running 2026.1 and earlier. The company contacted a limited number of affected customers but did not disclose a total.
Why the original patch was insufficient
The first vulnerability, CVE-2026-18556, is described by N-able as an unauthenticated administrative account takeover and classified as CWE-288, an authentication bypass through an alternate path or channel. It also scores 8.2 under CVSS 4.0 and covers releases through 2026.1.
N-able said version 2026.2 fixed the original path, but it subsequently found another way to exploit the same vulnerability. That alternative became CVE-2026-18577 and extended the vulnerable range to every build before 2026.3.1.7. Finland's national cyber security centre said all versions available before the emergency hotfix were vulnerable.
Indicators and investigation steps
N-able published six IP addresses associated with the attacks and advised customers to look for svchost.exe in users' Documents folders, a service named Cloudflared, or traffic involving those addresses. Huntress identified four initially listed addresses as Mullvad or NordVPN exit nodes, so matches should be correlated with N-central UI, network and endpoint logs rather than treated as proof by themselves.
Huntress observed exploitation through one self-hosted N-central instance in a partner account. Attackers reached nine organisations, accessing one endpoint in each, and the activity seen so far was limited to enumerating running processes before disconnection. Huntress did not observe the Cloudflare installation activity described by N-able.
For suspected unauthorised Take Control sessions, Huntress recommends correlating ui_access_control.log with C:\ProgramData\GetSupportService_N-Central\Logs\BASupSrvc_*.log.gz on Windows endpoints. These records also appear during legitimate support activity, so context is essential.
The immediate business action is twofold: upgrade every N-central server to 2026.3.1.7 and investigate the endpoints it managed. Patching the server does not remove tunnel services or other persistence already installed on separate machines, so containment is incomplete until downstream systems have been checked and cleaned.