Critical N-able N-central CVE-2023-40578 Lets Attackers Seize RMM Control

Key Takeaways

• A critical vulnerability, CVE-2026-18577, has been discovered in N-able N-central, allowing unauthenticated administrative access.
• The flaw impacts all supported N-central versions, including cloud and on-premises deployments, and is actively being exploited.
• Attackers can leverage this vulnerability for supply-chain attacks, gaining control over client systems managed by compromised N-central instances.
• N-able has released hotfix version 2026.3.1.7, and immediate patching is strongly recommended.

N-able N-central Vulnerability Exposes RMM Platforms to Attackers

N-able has issued a critical security alert concerning a severe vulnerability in its N-central remote monitoring and management (RMM) platform. This flaw grants unauthorized attackers complete administrative control, often referred to as “god-mode,” over the RMM console without needing any authentication.

The vulnerability, identified as CVE-2026-18577, impacts all currently supported N-central versions, encompassing both cloud-hosted and on-premises installations. Disturbingly, reports confirm that this vulnerability is already being actively exploited in real-world scenarios.

According to details shared by Huntress, CVE-2026-18577 emerged as an incomplete fix for a previous issue, CVE-2026-18556. This oversight enabled an authentication bypass and subsequent account takeover for N-central versions up to 2026.3.1. Consequently, remote attackers can bypass login credentials to access the management platform, inheriting the elevated privileges typically reserved for managed service provider (MSP) administrators and their technical teams.

Given the widespread adoption of N-central by MSPs for monitoring, patching, automation, and remote control of client endpoints, a compromise of a single N-central server presents a high-risk supply-chain incident. Such an event could cascade, impacting numerous downstream organizations managed by the affected MSP.

An attacker achieving console-level access could execute arbitrary scripts, deploy malicious tools, schedule tasks, modify roles and policies, or initiate remote-control sessions on servers and workstations managed through the platform, leading to significant data breaches or operational disruptions.

N-able’s Response and Remediation

In response to this critical vulnerability, N-able swiftly released hotfix version 2026.3.1.7 on August 2nd. The vendor has strongly urged all customers to upgrade their systems immediately. N-able’s status page confirms that this update specifically addresses CVE-2026-18577 and is compatible with upgrades from versions 2025.4, 2026.1, 2026.2, and 2026.3.

Customers operating on older N-central versions must first upgrade to a supported path before applying the hotfix. Cybersecurity firm Huntress has reported observing exploitation of this vulnerability within at least one of its customer environments.

Huntress’s investigation suggests that threat actors might be abusing N-central’s “Take Control” functionality to pivot into managed systems. Once inside, they appear to be deploying Cloudflare-based tunnels to establish persistent access. Comprehensive details regarding the root cause of the vulnerability have not yet been publicly disclosed, indicating that detection guidance may still evolve as more information becomes available.

What You Should Do

• Patch Immediately: Apply N-able N-central hotfix version 2026.3.1.7 without delay. Ensure you are on a supported upgrade path if running older versions.
• Limit Exposure: Restrict public internet access to N-central consoles. Implement strict firewall rules, IP whitelisting, VPN connections, and single sign-on (SSO) where possible.
• Enforce MFA: Mandate multi-factor authentication (MFA) for all N-central accounts. While MFA alone doesn’t prevent authentication bypass, it adds a crucial layer of defense against other compromise vectors.
• Monitor for Anomalies: Proactively review N-central login, account changes, job executions, and remote-control activities for any suspicious behavior. Pay close attention to new administrator accounts, unexpected privilege escalations, large-scale automation tasks, unusual access times, and remote sessions targeting critical infrastructure like domain controllers or file servers.
• Examine Endpoint Logs: Investigate Take Control-related logs located at C:ProgramDataGetSupportService_N-CentralLogs for any signs of misuse, keeping in mind legitimate support activities also generate these logs.
• Incident Response Plan: Any suspicious connection or activity involving an N-central console should trigger a full incident response review. This must include an assessment of potentially affected endpoints, compromised accounts, executed scripts, and all remote sessions initiated post-intrusion.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.