CISA has issued a warning that cybercriminals are actively exploiting a critical authentication bypass flaw in N-able's N-central system. This vulnerability, tracked under CVE-2026-18577, affects servers running versions prior to 2026.3.1.7 and can be exploited by attackers to gain unauthorized access across multiple managed environments. N-central is a remote monitoring and management platform commonly used by service providers to manage customer systems.
The flaw allows for an alternate path or channel, classified as CWE-288, enabling attackers to move laterally within the network. Following their infiltration, the threat actors created a new Cloudflare Tunnel service, enabling persistent access even after revoking initial N-central server privileges. CISA advised organizations to assess internet exposure, follow vendor instructions, and stop using the product if mitigations are unavailable.
The vendor emphasized ongoing investigation and potential additional indicators. Organizations should review logs, account activities, remote access sessions, newly created services, and Cloudflare Tunnel configurations to ensure thoroughness. Administrators must promptly patch N-central systems, enforce multi-factor authentication, audit privileged accounts, and monitor managed endpoints for any unusual remote-control activity or persistence mechanisms.
