A broken patch on a widely deployed remote monitoring tool left a door wide open for attackers. N-able disclosed on August 2 that a previously fixed vulnerability in its N-central platform — used by managed service providers to monitor and control client infrastructure — had a second exploitation vector that the original fix never closed. The result: hackers gained admin-level access to N-central servers, hijacked the built-in Take Control feature, and pushed Cloudflare tunnels onto managed endpoints to maintain persistence even after the initial breach was plugged.
The company assigned CVE-2026-18577 to the new flaw, describing it as "an incomplete patch for CVE-2026-18556" that allows authentication bypass and account takeover in N-central versions through 2026.3.1. The hotfix, released the same day, bumps the platform to version 2026.3.1.7. Auto-hosted instances received the fix automatically, but every self-implemented deployment must be updated manually — and Huntress, the managed security firm tracking exploitation, reported that a large portion of those servers remain exposed.
The Timeline: From Licensing Glitch to Zero-Day Exploitation
The incident started surfacing on July 31, when N-able noticed a spike in licensing errors across on-premises N-central installations. "Licensing issues are not uncommon, but the volume was high and the engineering and security teams were engaged," the company wrote in its August 2 advisory. The root cause turned out to be far more serious than a licensing bug.
On the morning of August 2, the security team discovered that attackers had found a new vector to exploit CVE-2026-18556, a flaw N-able had already patched in version 2026.2. The original fix blocked one path to the vulnerability, but a second path remained open. Attackers had been leveraging it against all N-central servers running versions prior to 2026.3.1.7 — which, at the time, included every version since the original patch was deployed.
The exploit gives remote attackers administrative access without authentication. Once inside, they hijacked the Take Control feature — a legitimate remote-access capability built into N-central for MSP technicians — to connect to managed endpoints across the customer's environment. On those endpoints, the attackers installed a Windows service masquerading as "Cloudflared," creating a Cloudflare tunnel that persisted even after the compromised N-central server was patched and the attackers' access revoked.
N-able confirmed that a "limited" number of customers were directly impacted and said its support team had reached out to each one. But the downstream risk is larger than N-able's own customer count suggests: each compromised N-central instance gave attackers access to every client endpoint that MSP managed through that server.
55 Percent Unpatched: Huntress Raises the Alarm
Huntress began tracking the exploitation within hours and published its first update on August 2, painting a grim picture. At the time of their initial assessment, more than half — 55.6 percent — of the N-central cloud servers reachable by Huntress's partners and customers had not applied the hotfix. The number was especially alarming given the nature of the N-central appliance itself.
"The N-able server runs a custom distribution of AlmaLinux 9, and does not often have EDR software deployed on it due to running as an appliance," Huntress researchers noted. The platform's hardened, appliance-like design means it flies under the radar of endpoint detection tools that would normally flag suspicious activity on a standard server.
By the time Huntress published its August 3 update at 2:15 PM ET, the picture had improved: nearly all cloud-hosted servers were patched, and overall exposure dropped to about 13.6 percent of reachable instances. But among self-hosted deployments, the numbers remained stubborn. "28.6% of the reachable N-central self-hosted servers are still unpatched," Huntress reported. Self-hosted servers require manual intervention, and many MSPs running their own infrastructure may not have the staffing or urgency to patch a system they believed was already secured by the original CVE-2026-18556 fix.
Huntress also uncovered a key detail about the attackers' operational security: the initial IP addresses N-able flagged as malicious were actually exit nodes belonging to Mullvad VPN and NordVPN. The firm identified 87.249.138.34 as a NordVPN exit node and 37.19.210.32 as a Mullvad node that had prior abuse history linked to brute-force campaigns and spam operations. Two additional malicious IPs — 37.153.90.88 and 92.118.112.181 — were later added by N-able.
What Attackers Did Once Inside
The exploitation pattern was consistent across the organizations Huntress tracked. Attackers performed high-level reconnaissance first, specifically targeting Domain Controllers and other high-value servers — a sign they were selectively choosing targets rather than spraying broadly. After gaining a foothold, they enumerated running processes on the compromised system, then moved rapidly across multiple hosts in the victim's environment.
Huntress published telemetry showing Windows Application Event Logs with Event IDs 4102, 8192, and 8193 — the normal logs for Take Control sessions — but flagged connections originating from one of the known malicious IP addresses and using the default "MSP Support" username. The attackers exploited the fact that Take Control sessions, when initiated from the N-central console, look identical to legitimate administrator activity in the event logs.
The persistence mechanism — a Cloudflare tunnel registered as a Windows service — was particularly clever. Cloudflare tunnels create an encrypted, outbound-only connection from the endpoint to Cloudflare's network, then allow the attacker to access the machine remotely through Cloudflare's infrastructure. Because the tunnel runs entirely over standard HTTPS and originates from the inside of the network, it bypasses most firewall rules and is extremely difficult to detect without dedicated monitoring.
N-able instructed customers to check their managed devices for two indicators: a file named svchost.exe placed in the Documents folder, and a registered Windows service called "Cloudflared." The company also shared a list of known malicious IP addresses and published automated detection templates that MSPs can deploy through N-central itself.
The Bigger Problem: RMM Platforms as Attack Vectors
The N-central incident fits a growing pattern of attackers targeting remote monitoring and management tools — the software MSPs use to manage hundreds or thousands of client environments from a single console. RMM platforms concentrate enormous trust in one place: a compromised N-central server does not just expose one organization but every client that MSP serves.
N-able acknowledged the gravity of the situation in its advisory, urging organizations not just to patch but to conduct a full environment review. "A clean result should not be interpreted as a guarantee that your environment has not been impacted," the company wrote, referring to its detection templates. "Our investigation is ongoing and additional indicators may be identified over time."
Huntress offered a measured assessment of the decision MSPs face. "Turning off N-central is a major decision, and it should be made based on risk, not panic," the firm's analysts wrote. "On one side, a compromised RMM can be used as a force multiplier against every downstream client you manage; on the other, taking N-central offline means losing central visibility, patching, and remote access when they may be needed most." For organizations in higher-risk environments, Huntress suggested temporarily disabling N-central until the hotfix is applied.
The attacker's use of Cloudflare tunnels represents an evolution in post-exploitation tradecraft. Traditional persistence mechanisms — scheduled tasks, registry modifications, lateral movement via stolen credentials — leave fingerprints that most EDR platforms detect. A Cloudflare tunnel, by contrast, piggybacks on legitimate Cloudflare infrastructure and uses standard HTTPS traffic that blends with normal business communications. For MSPs managing dozens or hundreds of clients, spotting a single rogue tunnel among thousands of legitimate connections requires a level of log analysis that many shops simply do not perform on a daily basis.
N-able's disclosure also highlighted the tension between rapid patching and operational continuity. Self-hosted N-central deployments often power monitoring for critical infrastructure at client sites — hospitals, manufacturing plants, government offices. Shutting down the platform to patch immediately means losing visibility into those environments precisely when the threat is highest. Huntress acknowledged this dilemma in its guidance, noting that the decision to temporarily disable N-central "should be made based on risk, not panic." The firm recommended that organizations unable to patch immediately should at minimum isolate their N-central servers from the internet, review all Take Control session logs from the past two weeks, and scan managed endpoints for the Cloudflared service indicator. The incident underscores a reality that keeps MSP security teams up at night: the tools they depend on to protect their clients can become the very pathway attackers use to reach them. And when a patch does not fully close a vulnerability — or when self-hosted servers go unpatched because administrators assumed the original fix was sufficient — the blast radius multiplies rapidly across every downstream customer on that platform.
Organizations running self-hosted N-central should upgrade to version 2026.3.1.7 immediately, review Take Control session logs for connections from unusual IP addresses, scan managed endpoints for the Cloudflared service indicator, and audit user accounts and permissions for unauthorized changes. N-able's CVE-2026-18577 detection templates are available through the company's developer portal, and Huntress continues to update its advisory as new indicators emerge.