When the Patch Wasn't the Patch: N-central's Auth Bypass Redux
If you run N-able N-central yourself, or an MSP runs it on your behalf, stop and read this one properly. CISA put CVE-2026-18577 into the Known Exploited Vulnerabilities catalog on 3 August, then followed up the next day by adding CVE-2026-18556 alongside two unrelated bugs. Two CISA advisories, one day apart, both pointing at the same product. That ordering is the whole story.
The interesting part is the "incomplete patching"
CVE-2026-18556 (CVSS 8.2) is an authentication bypass — "using an alternate path or channel," in CISA's phrasing — that lets an attacker reach an N-central server without valid credentials and take over an account. It got a fix. According to The Hacker News, that fix was incomplete, and CVE-2026-18577 (also 8.2) is the way around it. So the sequence is: hole found, hole patched, patch bypassed, and now both CVE IDs sit in KEV as actively exploited.
That is the bit worth internalising. If you patched N-central when the first advisory landed and mentally filed this as done, you are not done. The Hacker News reports the issue is addressed in version 2026.3 HF1. A version older than that — even one you patched recently — is still exposed to the bypass. "We already applied the update" is exactly the reasoning that leaves servers open here.
Why a mail admin should care about an RMM bug
N-central is a remote monitoring and management platform — Windows-centric, MSP territory, not something you'd normally see on this blog. But the blast radius is the reason I'm writing it up. Per The Hacker News, successful exploitation gives an attacker administrative access to the N-central server, and from there the built-in Take Control feature becomes a pivot into every managed endpoint. If your mail infrastructure — a Postfix relay, a Zimbra box, the Dovecot server holding everyone's spool — is managed by an MSP that runs N-central, then their compromised console is a direct path onto your servers. You don't have to run the vulnerable software to inherit the consequences of it. If you outsource management, the Monday task is a phone call: ask your provider whether they're on 2026.3 HF1 and whether they've reviewed Take Control activity.
Don't just patch — check whether you were already had
CISA's BOD 26-04 makes a point that applies to everyone, not just the federal agencies it binds: after a KEV bug, you're expected to check whether you were compromised before the patch went on. That matters more than usual here because N-able has acknowledged a "limited number of customers" were breached through CVE-2026-18577, and Huntress reported seeing it used against multiple organisations — targeted, not yet a broad spray.
The indicators N-able shared, via The Hacker News, are worth eyeballing by hand:
- A file named svchost.exe dropped in a device user's Documents folder — legitimate svchost never lives there.
- A registered service called Cloudflared — the real Cloudflare tunnel utility, abused here to open a covert outbound channel.
- Inbound connections from 173.249.252.200, 87.249.138.34, 37.19.210.32, or 68.235.46.214 — all reported as Mullvad or NordVPN exit nodes.
One observed intrusion came in via MSP Support, a default Take Control username, from that first IP. So legitimate-looking session names are part of the disguise; review the Take Control logs rather than trusting the account name.
FCEB agencies have until 6 August 2026 to fix. That's a floor, not a target. BleepingComputer also covered N-able's warning. Patch to 2026.3 HF1, then go looking for the footprints — because with an incomplete-patch chain like this, the attackers may have arrived before the fix that actually works.
Sources
- CISA Advisories — Adds One Known Exploited Vulnerability to Catalog
- CISA Advisories — Adds Three Known Exploited Vulnerabilities to Catalog
- The Hacker News — CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises
- BleepingComputer — N-able warns of N-central auth bypass flaw exploited in attacks
Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
More about the author →Was this article helpful?
Tap a star — no sign-in needed.
Be the first to rate this article.
Related guides
wp2shell Is Already in the KEV List — Patching Won't Un-Own You
CISA put two WordPress core flaws into its Known Exploited Vulnerabilities catalogue on 21 July, alongside a DD-WRT overflow and a Langflow bug. The pair that matters here — CVE-2026-63030 and CVE-2026-60137, chained under the name wp2shell — gives an anonymous attacker remote code execution against a stock WordPress install with a single HTTP request. No login, no plugin, no theme required. By the reporting in The Hacker News, exploitation was underway within hours of the public proof-of-concept, and watchTowr's honeypots logged tens of thousands of attempts.
Automate a Daily Failed-Logon (4625) Report with PowerShell
This guide builds a scheduled PowerShell job that reads Event ID 4625 (failed logon) from the Windows Security log for the last 24 hours and writes them to a dated HTML report. It is read-only — it queries the event log and creates a report file. It does not change auditing policy, delete events, or touch accounts.
Automate a Network Share Permissions Audit with PowerShell
This guide builds a read-only report . The script enumerates the SMB shares on a Windows file server, then lists two things for each one: the share-level permissions (the "who can connect" layer) and the NTFS permissions on the folder behind it (the "who can touch the files" layer). It writes both to CSV so you can review access in a spreadsheet instead of clicking through the Security tab share by share.
Audit Local Administrators Across Many Windows Machines
This is a read-only audit. It pulls a list of computers from Active Directory, connects to each one over PowerShell Remoting (WinRM), reads the membership of the local Administrators group, and writes everything to a single CSV you can open in Excel. It creates nothing and changes nothing on the target machines, so there is no destructive step and nothing to roll back — the only thing produced is the report file on your own workstation.