N-able warns of N-central auth bypass flaw exploited in attacks

N-able has warned customers of active exploitation of an authentication bypass vulnerability, CVE-2026-18577, affecting both hosted and on-premises versions of its N-central Remote Monitoring and Management (RMM) platform. The flaw, stemming from an incomplete patch for a previously addressed vulnerability (CVE-2026-18576), allows attackers to achieve administrative account takeover. N-able released hotfix 2026.3.1.7 to remediate the issue and urged all customers to upgrade immediately, with hosted deployments already updated. Indicators of compromise include malicious use of Cloudflared, suspicious IP addresses, and 'svchost.exe' located in user documents folders.

AI-extracted · verify before operational use