CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability, CVE-2026-18577, in N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. The flaw, stemming from incomplete patching of a prior vulnerability (CVE-2026-18556), enables authentication bypass and account takeover, allowing attackers to gain administrative access and pivot to managed endpoints using the Take Control feature. Indicators include malicious use of legitimate tools like Cloudflared and connections from specific IP addresses associated with Mullvad and NordVPN exit nodes. While no specific threat actor has been attributed, exploitation has been observed across multiple organizations, with attackers conducting reconnaissance, lateral movement, and persistence.

AI-extracted · verify before operational use