Last week, managed service providers scrambled to patch CVE-2026-18556, a critical authentication bypass in N-able's N-central remote monitoring platform. N-able released an emergency hotfix on August 3. By August 7, security researchers at Rapid7 and Huntress confirmed the obvious: the patch was incomplete. A second CVE, CVE-2026-18577, bypasses the fix entirely. Attackers are still taking over N-central servers.
The vulnerability arc
CVE-2026-18556 is an authentication bypass in N-able N-central (CVSS 8.2). It was added to the CISA Known Exploited Vulnerabilities catalog on August 3, with an FCEB remediation deadline of August 7. N-able simultaneously released N-central 2026.3 to address the flaw.
CVE-2026-18577 is what Rapid7 calls a server-side authorization logic flaw that was left unaddressed in that fix. A session with low-privilege credentials can call privileged administrative API endpoints through a logic error in how the server validates authorization for certain endpoint classes. An attacker who authenticates with any valid but low-privilege account can take over administrative functions of the entire N-central server. The CVSS score for CVE-2026-18577 is also 8.2.
The fixed version that addresses both CVEs is N-central 2026.3 HF1, released after the second bypass was confirmed. MSPs that applied the August 3 patch (N-central 2026.3) without the HF1 hotfix are still vulnerable to CVE-2026-18577.
Why this matters for MSPs specifically
N-central is a remote monitoring and management platform used by MSPs to administer client infrastructure. An MSP running N-central manages dozens to hundreds of client organizations from a single console. The Take Control feature allows administrators to access managed endpoints remotely. When attackers compromise N-central, they inherit that access to every managed endpoint.
Huntress researchers documented attackers actively using Take Control sessions to move laterally into client environments and deploying cloudflared, Cloudflare's tunneling binary, to establish persistent remote access that survives N-central remediation. The cloudflared deployment is particularly difficult to detect because it creates outbound HTTPS connections to Cloudflare's infrastructure, which is on most allowlists.
N-able's hosted N-central environments received the HF1 patch automatically. On-premise deployments require manual upgrade to 2026.3 HF1. Any MSP running on-premise N-central should verify they are on this specific build before treating the system as remediated.
The durable lesson: patch completeness
The N-able incident is a useful case study in incomplete patching. The pattern appears regularly: a critical vulnerability is disclosed, an emergency patch ships under pressure, and the patch introduces or leaves open a secondary bypass. This is not unique to N-able; the pattern has appeared in prior incidents across enterprise software, network gear, and web frameworks.
The lesson for teams responsible for applying emergency patches: verify the fix is complete before de-escalating. For N-able specifically, this means checking the exact build number (2026.3 HF1) rather than just confirming 2026.3 was applied. More broadly, it means treating 'patch applied' and 'vulnerability closed' as two separate questions, especially when the vendor releases follow-on hotfixes within days of an initial emergency release.
Immediate actions
For N-able N-central on-premise deployments: confirm you are running 2026.3 HF1. If you applied 2026.3 but not HF1, apply HF1 immediately. For hosted deployments: verify with N-able that your environment received the HF1 patch automatically.
If you were running N-central during the August 1 to August 8 window without HF1 applied, review Take Control session logs for unexpected sessions. Check for cloudflared running as a service or in the process list on your N-central server and on managed endpoints. Look for new administrative accounts or permission changes in N-central that were not initiated by your team. Treat any anomalous sessions from that window as potential indicators of compromise.
Gigia Tsiklauri is a cybersecurity analyst and the founder of infosec.ge. Reach out to discuss threat intelligence or collaboration.