One RMM server. Thousands of managed endpoints. Zero credentials required.
CVE-2026-18577 is an authentication bypass in N-able N-central — the platform MSPs and IT teams use to centrally administer servers, workstations and network devices. CVSS 8.2, exploited in the wild since August 1, added to CISA KEV on August 3. And it exists because the fix for the previous bypass, CVE-2026-18556, was incomplete.
WHAT ACTUALLY HAPPENED
An unauthenticated remote attacker can bypass authentication and obtain administrative control of a vulnerable N-central server. From there, the observed tradecraft was brutally simple: attackers used the platform's own Take Control feature to reach managed endpoints, then deployed Cloudflare Tunnel (cloudflared) for persistent remote access.
N-able shipped hotfix 2026.3.1.7, then a second hotfix on August 10 as exploitation continued. CVE-2026-18556 was added to KEV on August 5 — both halves of the story are now known-exploited.
WHY PATCH-BYPASS BUGS DESERVE THEIR OWN PLAYBOOK
A vulnerability that returns because the first patch was incomplete breaks the mental model most teams run on: "patched" becomes a permanent state instead of a claim that needs re-verification.
The blast radius makes it worse. Management tooling is designed for legitimate mass remote control, so an attacker inside it does not need malware, lateral movement, or privilege escalation — the product already does all three, and the activity looks exactly like normal administration in your logs.
WHAT TO DO NOW
APPLY BOTH HOTFIXES AND CONFIRM THE VERSION — hotfix 1 was not sufficient; verify you are on 2026.3.1.7 or later rather than trusting the patch record.
HUNT FOR CLOUDFLARED YOU DID NOT DEPLOY — an unexplained Cloudflare Tunnel binary on a managed endpoint or on the N-central server itself is a compromise indicator, not a shadow-IT footnote.
AUDIT TAKE CONTROL SESSION HISTORY SINCE AUGUST 1 — remote control sessions with no matching ticket are your fastest path to scoping.
PUT YOUR MANAGEMENT PLANE BEHIND ITS OWN FRONT DOOR — RMM consoles should sit behind VPN or IP allowlisting with phishing-resistant MFA, never openly exposed to the internet.
Attackers stopped writing custom implants because your management tools are better than anything they could build.
If your RMM console were compromised tonight, how long would it look like normal admin traffic?