Attackers Exploit N-central CVE-2026-18577, Hotfix Released

A critical security vulnerability in the N-central remote monitoring and management platform is being actively exploited, allowing attackers to gain administrative control over servers and the thousands of endpoints they manage. The software vendor, N-able, released an emergency hotfix on August 2, 2026, but cybersecurity researchers warn that a significant portion of vulnerable servers remain unpatched.

The flaw, tracked as CVE-2026-18577, is an authentication bypass that affects all N-central versions prior to 2026.3.1.7. It enables a remote attacker to take over an administrator account without valid credentials, granting what researchers have described as "god-mode" control over the platform's console. N-central is widely used by managed service providers (MSPs) to remotely monitor, patch, and support IT systems for their clients, making it a high-value target.

N-able's investigation began on July 31 after the company noticed an unusual spike in licensing errors for on-premises customers. This led engineers to discover that a previously patched vulnerability, CVE-2026-18556, could still be exploited via an alternate method. The new finding was assigned CVE-2026-18577 and...