NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

N-able N-central login bypass CVE-2026-18577 exploited; second hotfix required

Attackers used N-central's login bypass to take administrative control and reach customers' computers. IT providers must install Hotfix 2 (2026.3.1.10) or later and check for intruders; Hotfix 1 alone is insufficient.

What to do

If an IT provider manages your family's or business's computers, ask whether it uses N-central and has installed a current release containing Hotfix 2 (2026.3.1.10) or later. Ask it to check managed computers, user accounts and remote-access activity for compromise, especially if patching was delayed.

What’s happening

Attackers exploited CVE-2026-18577 to enter N-able N-central without signing in and gain administrative control. N-central is used by IT teams and managed service providers to administer customers' computers, so the risk extends to those managed devices. Rapid7 describes the flaw as the result of an incomplete earlier fix. Attackers used N-central's Take Control feature to reach managed computers and established persistent remote access. N-able released Hotfix 1 on 2 August, then required Hotfix 2, build 2026.3.1.10, on 6 August after identifying a related attack path. Hosted environments received mitigations automatically. N-able's latest incident statement found in this review, dated 10 August, said affected customers had been contacted and the investigation continued. Updating closes the entry route but does not clear an existing compromise.

What
Flaw
Affects
N-able N-central remote monitoring and management platform
Affected
N-able N-central hosted and self-hosted deployments before 2026.3.1.10, including Hotfix 1 (2026.3.1.7)
Fixed in
N-central 2026.3 Hotfix 2, build 2026.3.1.10
Hosted N-central: mitigations applied by N-able
CVE
CVE-2026-18577
Since
3 Aug 2026
Closed
10 Aug 2026

Timeline

  1. Vendor revised

    N-able said it had contacted the limited number of customers identified as affected; its investigation remained open. It warned that patching would not remove attackers already present and urged account and activity reviews.

  2. New fixFixed

    N-able released Hotfix 2, build 2026.3.1.10, requiring installation even where Hotfix 1 was already applied. It said hosted environments had already received mitigations.

  3. CISA added

    CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities catalogue, according to Rapid7.

  4. New fixPartly fixed

    N-able released N-central 2026.3 Hotfix 1, build 2026.3.1.7, for CVE-2026-18577. This was subsequently superseded because another related attack path remained.

  5. Made public

    N-able issued its first public guidance and upgrade recommendation, according to its later incident timeline.

  6. UpdateNo fix yet

    N-able says its Adlumin monitoring detected an attacker exploiting a previously unknown N-central vulnerability in a customer's environment.

Sources

  1. N-central 2026.3 Hotfix 2 – Additional Mitigation for CVE-2026-18577N-able · 6 Aug 2026
  2. N-central Security Update – August 10, 2026N-able · 10 Aug 2026
  3. 2026.3 HF1 Release NotesN-able · 2 Aug 2026
  4. N-central 2026.3 Hotfix 1 – Mitigation for CVE-2026-18577N-able · 2 Aug 2026
  5. CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the WildRapid7 · 9 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS