N-able N-central Hotfix 2 (2026.3.1.10) is mandatory even for instances that already applied Hotfix 1 — and the attackers reached the managed endpoints, not just the server
UPDATE · originally covered N-able N-central post-exploitation, unpacked: six remote-access tools pushed to managed endpoints, a Cloudflare tunnel renamed as a Microsoft updater, and an EDR-evasion driver staged from a remote-support directory (2026-08-05)
The remediation named in this pipeline's earlier coverage is no longer the endpoint. N-able published N-central 2026.3 Hotfix 2, build 2026.3.1.10, on 2026-08-06, and states that it is not a duplicate of the previous communication: Hotfix 2 is required even for partners who already applied the earlier hotfix, and it supersedes Hotfix 1 with additional hardening measures (N-able, 2026-08-06). The vendor frames it as proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques, rather than as a fix for a newly identified flaw (N-able, 2026-08-06). On-premises instances can upgrade directly to 2026.3.1.10 from 2025.4, 2026.1, 2026.2, 2026.3 or the 2026.3.1 Hotfix 1 build, and hosted N-central (NCOD) environments have already had the mitigations applied and require no customer action; the hotfix itself does not require agents to be upgraded to protect against CVE-2026-18577 (N-able, 2026-08-06).
The second half of the delta is the blast radius. The Hacker News reports on 2026-08-08 that in the attacks N-able observed, the flaw let attackers obtain administrative access remotely and then use N-central's own Take Control feature to connect to systems inside the managed environment, where they registered a new service for a Cloudflare Tunnel that kept them in even after access to the N-central server was revoked (The Hacker News, 2026-08-08). N-able detected the unusual activity in a customer environment on 2026-07-31 and has confirmed a limited number of customers were affected; it has published an expanded set of network indicators and a custom service template that checks Windows endpoints in N-central against known indicators, while cautioning that a clean result should not be read as a guarantee that an environment was not impacted and should sit alongside a review of logs and account activity (The Hacker News, 2026-08-08).
Triage: a Cloudflare Tunnel client running as a service is not inherently malicious — it is ordinary infrastructure in plenty of estates, and RMM platforms legitimately install services on managed endpoints all day. The discriminator here is provenance and timing: the service appears on endpoints during or after the window in which the N-central server was exploitable, it was created through the RMM's own remote-control session rather than through a change ticket or a deployment policy, and it keeps beaconing after the management platform's access has been cut. Any one of those alone is weak; the sequence is the signal.
This is not a duplicate of our previous communication — Hotfix 2 is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers.
Upon gaining access to those devices, the threat actors registered a new service for a Cloudflare Tunnel, enabling persistence even after access to the N‑central server was revoked.
Defender actions
- Upgrade on-premises N-central to 2026.3.1.10 even where 2026.3.1.7 was already applied — the vendor states Hotfix 2 is required regardless and supersedes Hotfix 1; hosted NCOD instances need no action.
- Extend the compromise assessment from the N-central server to the endpoints it manages, looking specifically for a newly registered service running a Cloudflare Tunnel client, which the vendor reports survives revocation of access to the N-central server.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Command and Control TA0011
T1219Remote Access Tools
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
T1572Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.