N-central's incomplete patch: auth bypass exploited in the wild, and CISA gives three days

On August 2, N-able shipped hotfix 2026.3.1.7 for N-central, its remote monitoring and management (RMM) platform, after confirming attackers had been exploiting an authentication bypass in the wild since July 31. The bug, CVE-2026-18577, is not a new hole: CISA's Known Exploited Vulnerabilities entry describes it as "the result of an incomplete patch for CVE-2026-18556," the flaw N-able had already fixed in version 2026.2.

God-mode by design

An RMM console exists to administer other people's fleets, so authentication bypass here is not one server compromised — it is every endpoint that server manages. N-able's security update says the flaw "allowed them to obtain administrative access remotely," after which attackers used the platform's own Take Control feature to reach managed systems and established persistence via Cloudflare tunnels. Huntress, which observed exploitation against its customer base, spelled out what console access means in practice:

Push new scripts and jobs to many or all managed endpoints

Huntress, on what an attacker with N-central console access can do

— alongside remote-control sessions "into servers and workstations, including domain controllers." For the MSPs that run N-central, the blast radius is their entire client list.

Three days from CISA

CISA added CVE-2026-18577 to the KEV catalog on August 3 with a required-action due date of August 6 — a three-day window, classifying it as CWE-288, "Authentication Bypass Using an Alternate Path or Channel." The required action tells agencies to apply the vendor mitigations or "discontinue use of the product if mitigations are unavailable." Due dates that short are the catalog's loudest signal.

The patch race, measured

Huntress published rare telemetry on how fast an ecosystem actually patches under fire. As of August 3 at 12:45 AM ET, "More than half (55.6%) of partners' and customers' reachable cloud servers were still unpatched." By 2:15 PM ET the same day, cloud-hosted servers were almost all updated and "13.6% reachable servers overall are still unpatched" — the residue being largely on-premises installs, which N-able's status post says must be upgraded manually via the support portal. Direct upgrades to 2026.3.1.7 are supported from versions 2025.4, 2026.1, 2026.2 and 2026.3; older installs need intermediate hops first. The status post's own phrasing: "It is highly recommended that all partners upgrade to this hotfix ASAP."

What to check, even after patching

Because exploitation predates the fix by two days, patching alone does not clear an install. N-able published six malicious IP addresses and a detection template through its developer portal; its status post tells operators to look for "a file called 'svchost.exe'" (the tunnel binary masquerading under a Windows name) and a service named "Cloudflared," and to review firewall logs against the published addresses. The standing advice applies with extra force to a console this powerful: keep it off the open internet behind a firewall or VPN, enforce MFA, and audit recent Take Control sessions — an attacker who held admin before August 2 may have left jobs, scripts or role changes that survive the upgrade.

The uncomfortable core of the story is the incomplete patch. CVE-2026-18556 was found, fixed and shipped — and the fix closed the reported path while leaving an alternate one open. The second CVE, the KEV entry, and two days of confirmed exploitation are the cost of patching the proof of concept instead of the root cause.

Primary sources: N-able N-central Security Update, August 2, 2026, N-able status post: N-central 2026.3 Hotfix 1, CISA Known Exploited Vulnerabilities catalog (JSON feed, catalog version 2026.08.03), Huntress: Critical N-able N-central Vulnerability and Active Exploitation, read 2026-08-04.