2026-08-03 · view entry permalink →
CVE-2026-18556 / CVE-2026-18577, N-able N-central: unauthenticated admin access to the RMM console, exploited in the wild, and the day-one fix was itself bypassable
N-able disclosed and then re-patched a critical authentication bypass in N-central, the remote monitoring and management platform managed service providers use to monitor, patch and remotely access customer estates. The vendor's own account of the attack is that "an attacker had identified a vulnerability on all N‑central servers running a version prior to 2026.3.1.7, which allowed them to obtain administrative access remotely" (N-able, 2026-08-02). The sequence matters as much as the flaw. N-able first addressed the issue in 2026.2 and, on 1 August, told customers still on older builds to move to 2026.3 as an immediate protective measure (N-able, 2026-08-02); its initial advisory tied the exploitation to CVE-2026-18556, while the hotfix that followed pointed at CVE-2026-18577 (Huntress, 2026-08-03). What changed in between is that the vendor "identified an alternative method to exploit this vulnerability, which was not mitigated in our previous fix" (N-able, 2026-08-02). Huntress records the second identifier's published description as "an incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1" (Huntress, 2026-08-03). Hotfix build 2026.3.1.7 shipped the same afternoon (N-able status page, 2026-08-02). One discrepancy in the vendor's own material is worth resolving before you scope your estate: the status notice describes the issue as affecting every N-central instance not running 2026.3.1, while the security blog says the attacker reached all servers "running a version prior to 2026.3.1.7" and the published CVE description gives the affected range as through 2026.3.1. The blog and the CVE record agree with each other, so 2026.3.1 is affected and 2026.3.1.7 is the fixed build, for anyone sitting on 2026.3.1 the single digit is the whole decision.
N-able dates the start of the visible signal precisely: "On July 31, 2026, N‑able saw an increase in licensing issues for our on-premises N‑central customers", the anomaly that put its engineering and security teams on the investigation (N-able, 2026-08-02), which is why 31 July is the sensible left edge for scoping a look-back. Exploitation is confirmed but so far bounded: N-able says "A limited number of customers have been identified to be impacted" (N-able, 2026-08-02), and Huntress reports it "has seen exploitation impacting one organization in our customer base" as of publication (Huntress, 2026-08-03). What removes the comfort from those numbers is the blast radius of the product: Huntress states that "a compromised N-central server can be used to run scripts, push tools, and open remote sessions across every downstream endpoint it manages", including domain controllers, and that an attacker in the console can also create administrative accounts and loosen security-relevant policy (Huntress, 2026-08-03). The observed post-exploitation path is the platform's own tooling rather than malware: N-able records that "the attacker leveraged the Take Control feature and connected to systems within the N‑central managed environment" and that on those devices "the attackers registered a new service for a CloudFlare tunnel, enabling persistence into an environment after access to the N‑central server was revoked" (N-able, 2026-08-02).
Two facts from an update Huntress added on 3 August shape how any of this can actually be hunted. First, the platform's exposure is worse than the confirmed-victim count suggests: at the time of that update "more than half (55.6%) of our partners' and customers' reachable cloud servers were still unpatched" (Huntress, 2026-08-03). Second, the compromised asset is itself a telemetry gap; Huntress notes that "the N-able server runs a custom distribution of AlmaLinux 9, and does not often have EDR software deployed on it due to running as an appliance" (Huntress, 2026-08-03), so the endpoint agent that would normally carry this investigation is frequently absent from the one host that matters most. Detection therefore leans on the server's own application logs and on what the pivot leaves behind downstream. In web-application and authentication logs on the N-central server itself, the signal is administrative activity and remote-control sessions with no corresponding legitimate credential use, Huntress points defenders at the console's UI and remote-access logs and flags sessions whose viewer account presents as a vendor support identity, or that target domain controllers and file servers, or that fall outside the team's working pattern. On managed Windows endpoints, Take Control leaves log files under C:\ProgramData\GetSupportService_N-Central\Logs\, and in service-installation telemetry the durable artifact is an unexpected service registered under the name Cloudflared, and in file-system terms a binary named svchost.exe sitting in a user's Documents folder, both named by N-able as the things to look for on a device you suspect (N-able status page, 2026-08-02). The second is worth dwelling on: the real Windows service host only ever runs from the system directories, so that filename anywhere under a user profile is anomalous by construction. In egress telemetry the signal is outbound tunnel traffic from hosts that have no business originating it. Because the console bypass needs no credentials, Huntress advises that an N-central server still broadly reachable from the internet or other untrusted networks should be considered for temporary shutdown until the hotfix is applied and it can be returned behind strict network controls (Huntress, 2026-08-03).
Triage: the vendor's published network indicators are not a safe discriminator on their own. Huntress found that "the four IPs N-able initially flagged as malicious are actually Mullvad or NordVPN VPN exit nodes" (Huntress, 2026-08-03), shared commercial infrastructure that ordinary users and unrelated traffic also originate from, so a match is a prompt to investigate the session, never a finding in itself. Take Control log files under GetSupportService_N-Central\Logs\ are not themselves evidence of compromise; Huntress is explicit that "these logs are also created during legitimate Take Control usage" (Huntress, 2026-08-03), so they are a pivot rather than a detection. The discriminators are the surrounding facts: whether the session maps to a ticket or technician, whether the viewer identity is one of your own staff, the criticality of the target host, and the time of day. A service registered as Cloudflared, or an svchost.exe under a user's Documents folder, is the sharper signal; a remote-support session that legitimately used Take Control has no reason to leave either behind (N-able status page, 2026-08-02).
an attacker had identified a vulnerability on all N‑central servers running a version prior to 2026.3.1.7
we identified an alternative method to exploit this vulnerability, which was not mitigated in our previous fix
the attackers registered a new service for a CloudFlare tunnel, enabling persistence into an environment after access to the N‑central server was revoked
Exploitation is active in the wild; a compromised N-central server can be used to run scripts, push tools, and open remote sessions across every downstream endpoint it manages.
N-able's initial security advisory linked this critical vulnerability to CVE-2026-18556; while the subsequent hotfix pointed to CVE-2026-18577.
the threat actor used the compromised N-central server to access high-value endpoints such as a backup server, domain controllers, and application servers
the PhantomKiller endpoint detection and response (EDR) evasion tool loaded a driver named k.sys, which was located in C:\\ProgramData\\AnyDesk
based on evidence of active exploitation
This is not a duplicate of our previous communication; Hotfix 2 is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers.
Upon gaining access to those devices, the threat actors registered a new service for a Cloudflare Tunnel, enabling persistence even after access to the N‑central server was revoked.
the Storm-1175 group began deploying a new ransomware strain on August 2 called StormEncryptor
Microsoft has not formally confirmed the access vector, but noted that StormEncryptor deployments began the same day the flaw was disclosed.
Two developments turn the N-able N-central authentication bypass from a patching task into a compromise-assessment task. CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog on 2026-08-04, based on evidence of active exploitation (CISA, 2026-08-04). More usefully, Sophos X-Ops has published what the actor did after taking the console (Sophos X-Ops, 2026-08-04), the original coverage described the flaw and the incomplete first fix, but not the post-exploitation chain, and that chain is what determines whether the hotfix was sufficient.
On the management server itself, the actor created a new domain account under a backup-product name, reset existing administrator credentials, and enumerated accounts, domain-administrator group membership and installed security products before moving on (Sophos X-Ops, 2026-08-04). The reconnaissance is unremarkable; the account creation and credential reset are not, because they survive the platform being patched.
The console was then used as a distribution channel. Sophos records six different remote-monitoring-and-management tools pushed from the compromised N-central console onto reachable endpoints (AnyDesk, TacticalRMM, TeamViewer, RustDesk, SimpleHelp and HopToDesk) establishing remote access that no longer depends on N-central at all (Sophos X-Ops, 2026-08-04). That is the structural point for anyone who patched and moved on: the entry point was closed, and six independent ways back in were already in place. Alongside them a Cloudflare Tunnel client was deployed and renamed to a Microsoft-update-styled filename, giving persistent outbound tunnelling that blends into ordinary update traffic by name, and a kernel driver Sophos names PhantomKiller was loaded from a remote-support tool's ProgramData directory as an endpoint-detection-evasion component, in one instance terminating the endpoint vendor's own file-scanner process. The actor then used the management server to reach a backup server, domain controllers and application servers directly (Sophos X-Ops, 2026-08-04); an RMM platform's whole value is reach, and that reach transfers to whoever holds the console.
Hunt concepts, telemetry class first. In account-management telemetry, local and domain account creation events sourced from the N-central service-account context are the first artefact. In process-creation telemetry with parent lineage, account-enumeration and domain-trust utilities invoked by the N-central server process rather than by an interactive administrator session is a lineage anomaly no legitimate workflow produces. In software-inventory telemetry, the presence of any remote-monitoring agent an endpoint was never provisioned with is high-fidelity regardless of which product it is. In binary-integrity telemetry, a process whose filename claims a Microsoft update component but whose signature and hash do not match that publisher is the renamed tunnel client. In driver-load telemetry, a newly loaded kernel driver staged under a remote-access tool's data directory is the evasion component.
Triage: managed-service estates legitimately run remote-access tooling, and a second product can appear during a genuine tooling migration; the discriminators are whether the deployment correlates with a change record, whether it arrived through the console at a time no administrator was working, and whether the same push reached hosts outside the migration's scope. A signed remote-access binary is not itself suspicious; a signed remote-access binary that nobody in IT deployed is.
The remediation named in this pipeline's earlier coverage is no longer the endpoint. N-able published N-central 2026.3 Hotfix 2, build 2026.3.1.10, on 2026-08-06, and states that it is not a duplicate of the previous communication: Hotfix 2 is required even for partners who already applied the earlier hotfix, and it supersedes Hotfix 1 with additional hardening measures (N-able, 2026-08-06). The vendor frames it as proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques, rather than as a fix for a newly identified flaw (N-able, 2026-08-06). On-premises instances can upgrade directly to 2026.3.1.10 from 2025.4, 2026.1, 2026.2, 2026.3 or the 2026.3.1 Hotfix 1 build, and hosted N-central (NCOD) environments have already had the mitigations applied and require no customer action; the hotfix itself does not require agents to be upgraded to protect against CVE-2026-18577 (N-able, 2026-08-06).
The second half of the delta is the blast radius. The Hacker News reports on 2026-08-08 that in the attacks N-able observed, the flaw let attackers obtain administrative access remotely and then use N-central's own Take Control feature to connect to systems inside the managed environment, where they registered a new service for a Cloudflare Tunnel that kept them in even after access to the N-central server was revoked (The Hacker News, 2026-08-08). N-able detected the unusual activity in a customer environment on 2026-07-31 and has confirmed a limited number of customers were affected; it has published an expanded set of network indicators and a custom service template that checks Windows endpoints in N-central against known indicators, while cautioning that a clean result should not be read as a guarantee that an environment was not impacted and should sit alongside a review of logs and account activity (The Hacker News, 2026-08-08).
Triage: a Cloudflare Tunnel client running as a service is not inherently malicious; it is ordinary infrastructure in plenty of estates, and RMM platforms legitimately install services on managed endpoints all day. The discriminator here is provenance and timing: the service appears on endpoints during or after the window in which the N-central server was exploitable, it was created through the RMM's own remote-control session rather than through a change ticket or a deployment policy, and it keeps beaconing after the management platform's access has been cut. Any one of those alone is weak; the sequence is the signal.
The N-able N-central authentication-bypass chain this pipeline has tracked through two hotfixes now has an assessed actor and a named payload. Microsoft Threat Intelligence reported that "the Storm-1175 group began deploying a new ransomware strain on August 2 called StormEncryptor", and that the group is likely exploiting CVE-2026-18577 in N-central to obtain access (The Record, 2026-08-10). The hedge is Microsoft's own and matters: "Microsoft has not formally confirmed the access vector, but noted that StormEncryptor deployments began the same day the flaw was disclosed" (The Record, 2026-08-10). The same-day correlation is the evidence; a confirmed vector is not yet on the record.
The Record describes the actor as financially motivated and linked to China, and its prior activity is why the attribution changes a defender's calculus rather than just labelling it (The Record, 2026-08-10). Microsoft's own April 2026 profile of the group (which does not itself make a China attribution) describes high-tempo Medusa ransomware operations against vulnerable web-facing assets, and records the group moving from initial access to data exfiltration and ransomware deployment often within a few days and in some cases within 24 hours (Microsoft Threat Intelligence, 2026-04-06). Its earlier Medusa victims were healthcare, professional services and finance organisations in Australia, Britain and the United States; StormEncryptor is the departure from that tooling (The Record, 2026-08-10). Note what those sectors and countries describe: the group's previous victim set, not confirmed victims of this campaign, for which no count has been disclosed.
Two facts sharpen the exposure picture for anyone whose managed service provider runs N-central. N-able states it detected the original flaw in a zero-day attack on 31 July, though it is unclear whether the actor behind that first intrusion was Storm-1175; the initial patch was bypassed, forcing an emergency hotfix on 2 August and a second on 6 August with the warning that the first was not enough. And the patch gap is wide: after the fixes were available, Huntress found more than half of reachable N-central cloud servers across its partner base still unpatched, with 28.6% of self-hosted instances exposed (The Record, 2026-08-10). Huntress went as far as suggesting that anyone running N-central in a higher-risk environment where exposure cannot meaningfully be reduced may need to consider turning the tool off, while cautioning that doing so costs central visibility, patching and remote access when they may be needed most.
The structural point is the one this constituency should carry: a single compromised RMM server is a gateway to every endpoint it manages, so one breach at one provider cascades across its whole client base. The Record draws the direct comparison to the 2021 Kaseya intrusion, where REvil compromised around 60 direct customers and subsequently hit roughly 1,500 downstream businesses, and to the 2024 ScreenConnect attacks; in which Microsoft says Storm-1175 was among the actors targeting the product (The Record, 2026-08-10).