N-able has released an update for N-central, part of its efforts to address threats linked to a recently discovered vulnerability in RMM software. The firm stated that it is taking proactive measures to bolster security after monitoring continued attempts by attackers to exploit this issue. This message does not repeat any prior communications.
For this reason, Hotfix 2 remains necessary despite having previously implemented Hotfix 1. Hotfix 2 surpasses Hotfix 1 by introducing enhanced security features that provide greater protection for both the organization and its clients. The revelation reveals that N-able discovered suspicious activity within a customer's environment on July 31, 2026, following the detection of unknown threat actors exploiting a previously undisclosed vulnerability in the N-central server.
This issue affects all versions prior to 2026.3.1.7. It is important to mention that there remains a partial remedy for CVE-2026-18556 (CVSS score: 8.2), which allows for unauthorized access through authentication bypass and account hijacking in certain versions. Both vulnerabilities have been identified as being actively exploited by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
In the incidents reported by N-able, the vulnerability permitted attackers to gain remote administrative access and subsequently exploit Take Control to connect to systems within the N-central managed environment. After gaining control of those devices, the threat actors registered a new Cloudflare Tunnel service, ensuring persistence even after revoking access to the N-central server.
Additional information: N-able has released a custom service template that automates the detection of known IoCs (Indicators of Compromise) against Windows device endpoints within the N-central environment. A pristine outcome should not be considered a definitive assurance that your system has remained unharmed. Our examination remains active, and further evidence may emerge in the future.
We strongly advise this to be viewed as an additional safeguard along with a comprehensive evaluation of your infrastructure, logs, and user activities.
