Executive Summary
- •Threat actors exploited CVE-2026-18577 to gain administrative control over N-central servers.
- •Attackers used the Take Control feature to install Cloudflare Tunnels on endpoints for persistence.
- •N-able released Hotfix 2 and urges all on-premise users to update to version 2026.3.1.10 immediately.
Community Sentiment
Key Developments & Data
N-able $NABL issues Hotfix 2 for N-central as attackers breach managed systems.
Threat actors exploited CVE-2026-18577 to gain administrative access to N-central servers starting July 31, 2026.
Attackers leveraged the Take Control feature to access endpoints and registered Cloudflare Tunnels for persistent access.
The flaw stems from an incomplete patch for CVE-2026-18556 and is flagged by CISA as actively exploited.
N-able urges on-premise administrators to update to version 2026.3.1.10 immediately even if Hotfix 1 was installed.
"This is not a duplicate of our previous communication. Hotfix 2 is required, even if you already applied the earlier hotfix." — N-able
When an RMM tool gets breached, revoking server access does nothing after attackers plant backdoors across downstream endpoints.
Zubiqo Intelligence Briefing
Get the unfiltered signal before markets open.
Top tech breakthroughs, venture funding, and market moves—synthesized into a 2-minute morning read. Zero PR fluff.
✓ 100% Free•✓ 1-click unsubscribe•✓ No spam ever
Zubiqo Strategic Assessment
Primary Impact
Managed service providers (MSPs) and IT departments relying on on-premise N-able N-central servers for endpoint management.
Strategic Shift
Threat actors are weaponizing trusted RMM administrative tools to bypass traditional endpoint security and establish persistent access outside central server control.
The Ripple Effect
MSPs will face mandatory client endpoint auditing and heightened liability requirements following supply-chain management software compromises.
This intelligence assessment is generated by Zubiqo's AI for informational purposes only.
