N-able has released a second security hotfix for its N-central remote monitoring and management (RMM) solution, urging all partners to update immediately. This new hotfix, version 2026.3.1.10 (2026.3 Hotfix 2), provides additional hardening measures to protect against ongoing exploitation of CVE-2026-18577, an authentication bypass vulnerability. The company recommends upgrading agents on managed devices as well, though it is not strictly required for protection against this specific vulnerability. Customers using hosted N-central do not need to take action, as the hotfix has already been applied to their instances.
The vulnerability, CVE-2026-18577, is a patch bypass of a previously addressed flaw, CVE-2026-18556. Attackers reportedly found a variation that circumvents the specific checks implemented in the earlier patch, allowing them to compromise N-central instances and gain access to managed endpoints. N-able did not explicitly state whether the first hotfix was bypassed, but indicated that the expanded protections are a proactive response to evolving attack techniques.
N-able's Adlumin MDR solution first detected unusual activity within a customer environment on July 31, 2026, leading to the discovery of a threat actor actively exploiting a zero-day vulnerability in an N-central server. The company confirmed initial exploitation of CVE-2026-18577 on August 1, 2026, and subsequently released the first hotfix, version 2026.3.1.7 (2026.3 Hotfix 1), earlier in August.
Once the vulnerability is exploited, attackers are observed using the legitimate Take Control feature to connect to managed endpoints. From there, they establish persistence by registering a new service for a CloudFlare tunnel. N-able has shared a list of six IP addresses associated with these attacks.
Further analysis by security researchers has revealed additional post-exploitation activities. Attackers have been observed creating new domain accounts, such as one named "veeam," and resetting passwords for existing domain administrator accounts. They also enumerate other accounts, install additional remote-access tools, and disable security software from vendors like Microsoft and Sophos using EDR-evasion tools. Researchers have expanded N-able's initial list of indicators of compromise with four additional IP addresses and domain names for command-and-control and TacticalRMM servers.
In one observed incident, after exploiting the vulnerability, the threat actor targeted key servers, typically Domain Controllers. They enumerated processes on compromised systems before disconnecting and then moved rapidly across multiple hosts within the impacted organizations' environments. While exploitation is being observed across multiple organizations, it has not yet escalated into a broad, indiscriminate campaign across the partner base.
