N-able N-central auth bypass exploited for admin takeover and endpoint persistence

N-able disclosed active exploitation of two related authentication bypass flaws in its N-central remote monitoring and management platform, CVE-2026-18556 and the follow-on CVE-2026-18577, after determining the initial remediation was incomplete. The vulnerabilities, both mapped to CWE-288, allow unauthenticated attackers to take over administrative accounts on vulnerable N-central servers. N-able said attackers gained remote administrator access at a limited number of customer environments, while Huntress reported in-the-wild exploitation affecting both cloud-hosted and on-premises deployments and warned that many exposed servers remained unpatched.

After compromising N-central, attackers abused the platform’s Take Control feature to pivot into managed customer endpoints and, in some cases, installed Cloudflare Tunnel services to maintain persistence even after server access was cut off. Reporting tied the incident to unusual licensing errors seen by some on-premises customers, and community discussions highlighted unexpected unlicensed-server status as a possible indicator. N-able released version 2026.3.1.7 as the first unaffected build and urged immediate upgrading, log review, IOC hunting, and inspection of downstream devices because patching the N-central server alone does not remove persistence already established on managed endpoints.