N-central Breach: The First Patch Didn't Close the Hole, Attackers Took Over MSP Servers

N-able has warned customers about a series of attacks on N-central — the remote monitoring and management (RMM) platform used by managed service providers (MSPs) and in-house IT teams to administer client devices. Through an authentication bypass, attackers gained administrative access to the servers, and through them — to the endpoints those servers serve.

A patch that didn't patch

The investigation began on July 31, when on-premises customers started receiving unusual licensing errors en masse. It emerged that an attacker had remotely obtained administrative access to servers running build 2026.1 and earlier. The first vulnerability (CVE-2026-18556, “unauthenticated administrative account takeover,” CWE-288) was, according to N-able, closed in version 2026.2. Later, however, an alternative way to exploit the same flaw while bypassing the fix was found — and so CVE-2026-18577 appeared, expanding the range of vulnerable builds to include everything released before 2026.3.1.7. Both vulnerabilities were rated 8.2 on CVSS 4.0. The first safe build was 2026.3.1.7, released on August 2; the previously recommended upgrade to 2026.3 is no longer sufficient.

Tunnels that survive a reboot

After compromising a server, the attackers used the Take Control feature to reach the endpoint devices and registered Cloudflare tunnels on them as services. Such tunnels establish an outbound connection to Cloudflare's edge network, so they require neither inbound firewall rules nor open ports, and running as a service lets them survive a reboot. According to N-able, access through the tunnels persisted even after the route through the N-central server had been cut off. Cloudflare itself, the notice stresses, was not compromised — the attackers merely abused its service.

Hence an important corollary: updating N-central does not remove the persistence installed on another machine. Affected customers must separately locate and remove the malicious tunnel services on managed devices. Hosted NCOD instances will update automatically, while owners of self-hosted servers must update them themselves.

Indicators and assessments

N-able published six IP addresses observed in the attacks and advised looking for svchost.exe in users' Documents folders, a service named Cloudflared, and traffic from those addresses. Huntress determined that four of the addresses on the initial list were Mullvad or NordVPN exit nodes. Finland's National Cyber Security Centre warned on August 2 that all versions prior to the emergency hotfix were vulnerable.

In an emergency report on August 3, Huntress said it had observed exploitation at one self-hosted instance within a single partner account: the attackers gained access to nine organizations, reaching one endpoint in each, and, based on the available data, limited themselves to enumerating running processes before disconnecting. That said, Huntress did not observe the installation of the Cloudflare tunnels described by N-able.

N-able did not disclose the number or identities of those affected, the number of impacted devices, when the attacks began, attribution, or whether data was stolen.

Source: The Hacker News