N-able Releases Hotfix 2 for N-central Amid Active Attacks on Managed Systems

N-able has released a new set of fixes for its N-central remote monitoring and management (RMM) platform as part of an investigation into the ongoing exploitation of a recently disclosed vulnerability. According to the developers, the defenses are being expanded proactively as attackers refine their techniques.

The company stresses separately that Hotfix 2 does not duplicate the earlier fix and is mandatory to install even if Hotfix 1 has already been applied. The second update replaces the first and adds further hardening measures.

How it all began

On July 31, 2026, N-able detected unusual activity in the environment of one of its customers. The investigation led to the discovery of unknown attackers exploiting what was then a zero-day vulnerability in the N-central server — CVE-2026-18577 (CVSS score 8.2). It affects all versions prior to 2026.3.1.7.

A curious detail: this vulnerability stems from an incomplete remediation of an earlier flaw, CVE-2026-18556 (also CVSS 8.2). Both holes allow attackers to bypass authentication and take over an account, and both have been added by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its list of actively exploited vulnerabilities.

The mechanics of the attack

In the observed attacks, the vulnerability gave the attackers remote administrative access. They then leveraged the built-in Take Control feature to connect to systems within the managed N-central environment. Once they had access to the devices, the attackers registered a new service for a Cloudflare tunnel — this allowed them to maintain their presence even after access to the N-central server itself had been revoked.

N-able has confirmed that a limited number of customers were affected. Users of on-premise versions are advised to update immediately to 2026.3.1.10. The company has also published an expanded set of IP addresses as indicators of compromise and released a dedicated service template that automatically checks Windows devices in N-central for known indicators.

At the same time, the developers warn that a clean scan result does not guarantee that an environment was not affected. The investigation is ongoing and new indicators may surface later, so the automated check should be used only as one layer of assessment — alongside a thorough review of logs and account activity.

Source: The Hacker News