CISA Warns of Critical N-able N-central Auth Bypass (CVE-2023-47248) Exploited In Attacks

Key Takeaways

• A critical authentication bypass vulnerability, CVE-2026-18577, in N-able N-central is being actively exploited in the wild.
• The flaw affects N-central servers running versions prior to 2026.3.1.7.
• Exploitation grants attackers remote administrative access, potentially leading to broader compromise of managed environments.
• N-able has released a hotfix, and organizations are urged to upgrade to version 2026.3.1.7 immediately.

N-able N-central Authentication Bypass Under Active Exploitation

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a stark warning regarding active exploitation of a severe authentication bypass vulnerability within N-able N-central. Identified as CVE-2026-18577, this critical flaw impacts N-central servers operating on versions predating 2026.3.1.7.

N-central serves as a crucial remote monitoring and management (RMM) platform, widely adopted by managed service providers (MSPs) to oversee a multitude of client systems. Given its centralized control over numerous endpoint devices, a successful compromise of this platform could enable attackers to pivot and propagate across an MSP’s entire managed ecosystem, posing a significant supply chain risk.

Technical Details and Exploitation Path

CVE-2026-18577 is categorized as an authentication bypass vulnerability, specifically through an alternate path or channel, and is mapped to CWE-288. According to N-able, this issue stems from an incomplete patch for a previously identified security vulnerability, CVE-2026-18556.

Attackers have leveraged this vulnerability to gain unauthorized remote administrative access to vulnerable N-central servers. Once control of the server is established, threat actors have been observed utilizing the platform’s “Take Control” feature to access systems managed through the N-central instance. This direct access to client endpoints underscores the severity of the compromise.

Following initial access, the attackers established persistence by creating a new Cloudflare Tunnel service. This mechanism allowed them to maintain continued access to the compromised environment, even if their original access vector to the N-central server was subsequently revoked.

Timeline and Vendor Response

N-able first detected an increase in licensing issues among its on-premises N-central customers on July 31, 2026. During its subsequent investigation, on August 2, 2026, the company identified an additional method of exploitation. In response, N-able promptly released a hotfix for N-central 2026.3 and strongly advised all customers to upgrade to version 2026.3.1.7 without delay.

On August 3, 2026, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. Under Binding Operational Directive 26-04, federal civilian executive branch agencies are mandated to apply necessary mitigations by August 6, 2026.

CISA further recommended that all organizations assess their internet exposure, meticulously follow vendor instructions for mitigation, and, in cases where mitigations are not feasible, consider discontinuing the use of the affected product.

N-able has indicated that only a limited number of customers have been confirmed as affected and that its support teams have directly engaged with these organizations. The vendor, however, emphasized that its investigation is ongoing, and additional indicators of compromise (IoCs) may yet emerge.

The following IP addresses have been linked by N-able to the observed attacks: 173[.]249[.]252[.]200, 87[.]249[.]138[.]34, 37[.]19[.]210[.]32, 37[.]153[.]90[.]88, 92[.]118[.]112[.]181, and 68[.]235[.]46[.]214.

To assist administrators in detecting known indicators on Windows endpoints, N-able has also released a custom N-central service template. The company cautioned that a clean scan with this template does not definitively prove an environment is unaffected, urging a comprehensive review.

What You Should Do

• Patch Immediately: Upgrade all N-able N-central servers to version 2026.3.1.7 without delay.
• Enforce MFA: Implement and enforce multi-factor authentication (MFA) for all administrative and user accounts accessing N-central.
• Audit Privileged Accounts: Conduct a thorough audit of all privileged accounts within N-central and managed environments for any unauthorized access or modifications.
• Monitor Endpoints: Actively monitor all managed endpoints for unusual remote-control activity, the creation of new services (especially Cloudflare Tunnel), or other persistence mechanisms.
• Review Logs: Scrutinize N-central server logs, account activity, and remote access sessions for any suspicious entries.
• Check Cloudflare Tunnel Configurations: Verify Cloudflare Tunnel configurations across your environment for any unauthorized or newly created instances.
• Use N-able Template: Deploy and utilize the custom N-central service template provided by N-able to detect known indicators on Windows endpoints.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.