GoKawiilN-able is warning customers that hackers are exploiting an authentication bypass vulnerability (CVE-2026-18577) affecting both hosted and on-premises N-central servers.
The company on Sunday released hotfix 2026.3.1.7 to address the security issue, which affects all versions of N-central before 2026.3.
On August 1st, the vendor disclosed that it detected active exploitation and launched an investigation that uncovered additional security concerns affecting all versions of N-central, its flagship Remote Monitoring and Management (RMM) platform.
In an update the next day, the company announced the hotfix and strongly recommended all customers to upgrade immediately to the new release.
Hosted deployments already received the update, while customers of on-premises instances need to install it manually.
N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) and corporate IT departments to manage large clusters of multi-OS systems and network devices.
Because of this, compromising these servers allows threat actors to extend the attack beyond N-able’s direct customers.
The product was also targeted last year, in zero-day attacks that prompted CISA to issue an urgent alert.
In the past, threat actors compromised other notable RMM/MSP platforms, including Kaseya VSA, ConnectWise ScreenConnect, SimpleHelp, and SolarWinds Orion.
CVE-2026-18577 is the result of an incomplete patch for CVE-2026-18576, a vulnerability described as an “authentication bypass using an alternate path or channel, which affected all N-central versions through 2026.1. Both vulnerabilities could be exploited for administrative account takeover.
... continue reading