N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management (RMM) product.
“We are proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques,” the company said.
“This is not a duplicate of our previous communication. Hotfix 2 is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers.”
The disclosure comes as N-able acknowledged that it detected unusual activity within a customer’s environment on July 31, 2026, leading to the discovery of unknown threat actors exploiting a then-zero-day flaw in the N‑central server (CVE-2026-18577, CVSS score: 8.2). It impacts all versions prior to 2026.3.1.7.
It’s worth noting that CVE-2026-18577 relates to an incomplete fix for CVE-2026-18556 (CVSS score: 8.2). Both vulnerabilities, which allow authentication bypass and account takeover in susceptible versions, have been flagged as actively exploited by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
In the attacks observed by N-able, the vulnerability allowed the attackers to obtain administrative access remotely and then leverage the Take Control feature to connect to systems within the N‑central managed environment. Upon gaining access to those devices, the threat actors registered a new service for a Cloudflare Tunnel, enabling persistence even after access to the N‑central server was revoked.
N-able has confirmed that a limited number of customers have been affected by the exploitation activity. Customers running an on-premise version are advised to update their instances to 026.3.1.10 immediately. The company has also shared an expanded set of IP addresses as indicators of compromise (IoCs) –
- 173.249.252[.]176
- 173.249.252[.]200
- 185.156.46[.]150
- 23.234.94[.]43
- 37.153.90[.]88
- 37.19.210[.]32
- 68.235.46[.]214
- 68.235.46[.]235
- 87.249.138[.]34
- 92.118.112[.]181
In addition, N-able has released a custom service template that offers an automated way to check for known IoCs against Windows device endpoints in N‑central.
“A clean result should not be interpreted as a guarantee that your environment has not been impacted,” it said. “Our investigation is ongoing and additional indicators may be identified over time. We strongly recommend this be used as one layer of your assessment, alongside a thorough review of your environment, logs, and account activity.”
