N-able N-central – God Mode on the Management Plane, and the Hotfix That Wasn't Enough

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

At the start of August 2026, attackers exploited an authentication bypass in N-able's N-central remote monitoring and management platform to obtain full administrative control of the console - and then used the product's own legitimate remote access feature to reach the machines it manages. The vendor shipped a fix. It was not enough.

The six-day timeline. 1 Aug: N-able detects active exploitation of CVE-2026-18556 (CVSS 7.4 under v3.1, 8.2 under v4.0); all versions affected, hosted and on-premises. 2 Aug: hotfix 1, build 2026.3.1.7, plus a second advisory for CVE-2026-18577 - the residual bypass left by the incomplete fix (8.1 under v3.1, 8.2 under v4.0). 3 Aug: CISA adds 18577 to the Known Exploited Vulnerabilities catalogue. 4 Aug: CISA adds 18556; N-able confirms attackers obtained administrative access. 6 Aug: hotfix 2, build 2026.3.1.10 - required even if hotfix 1 was already applied.

The patch-rate gap. Huntress observed 55.6% of reachable cloud N-central servers unpatched early on 3 August, falling to 13.6% overall by that afternoon - but 28.6% of reachable self-hosted servers were still unpatched. Hosted customers were fixed by the vendor; self-hosted ones had to fix themselves.

The attack chain. Unauthenticated bypass to full admin ("god mode"), then abuse of the built-in Take Control remote access feature - with sessions logged under the default legitimate "MSP Support" account, so the attack looks like ordinary support work. Then domain controller reconnaissance, and persistence via a Cloudflare Tunnel (cloudflared) registered as a Windows service plus a suspicious svchost.exe in a user's Documents folder.

No attribution - at all. Not formal, not suspected, not claimed. All ten published indicator IPs are Mullvad or NordVPN exit nodes. No ransomware was observed and no extortion claims have surfaced.

Hunting artefacts: ui_access_control.log for the indicator IPs and the mspsupport identity; the Take Control logs under ProgramData; Windows event IDs 4102, 8192 and 8193; and any cloudflared service you did not install.

Five durable lessons: give the management plane identity-provider-grade controls, including IP allow-listing and MFA on every operator account; recognise that the on-premises appliance is usually the one machine in your estate without EDR; understand that applying the vendor patch is not the same as being safe; treat remote control sessions as security events and review the out-of-hours ones weekly; and if you buy IT services, ask your provider precisely when they applied the August hotfixes.

Because when a database is breached you lose data. When your management plane is breached, you lose the ability to trust anything else you are looking at - including your logs and your patch reports.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: N-able security advisories for CVE-2026-18556 and CVE-2026-18577 (1-6 August 2026); Huntress, "N-able vulnerability exploitation" (3 August 2026); BleepingComputer; Rapid7 Emergent Threat Response for CVE-2026-18577; Horizon3.ai attack research; CISA Known Exploited Vulnerabilities catalogue additions, 3 and 4 August 2026; The Hacker News; The Register.