CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises

N-able N-central, an RMM platform widely used by managed service providers, contains an OS command injection flaw (CWE-78) caused by improper input validation (CWE-20), allowing an attacker to execute arbitrary operating-system commands on the N-central server. The flaw is reachable over the network (AV:N) and requires only low-privileged access with no user interaction, per the CVSS 4.0 vector. Successful exploitation yields high impact on confidentiality, integrity, and availability, and the 'subsequent system' impacts indicate compromise can extend beyond the N-central server itself, putting all endpoints that the affected MSP manages at risk. All N-central deployments running versions before 2025.3.1 are affected. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-08-13 following reported customer compromises, though no public proof-of-concept is known and ransomware use is unknown.

Do: Upgrade N-central to version 2025.3.1 or later immediately, as the flaw is under active exploitation and CISA KEV requires federal agencies to apply vendor mitigations per BOD 22-01 or discontinue use. MSPs should check their N-central servers for signs of compromise, review accounts for anomalous or low-privileged sessions, and assume downstream managed endpoints may be at risk given the subsequent-system impact. Note that this is one of two recently patched N-central flaws being exploited in the wild, so ensure all recent hotfixes (multiple releases in recent weeks) are applied.

N-able's N-central RMM platform contains an authentication bypass (CWE-288) in which an alternate path or channel allows requests to skip the normal authentication check. An unauthenticated attacker can trigger it by sending requests through that alternate path without valid credentials, gaining unauthorized access to the N-central management interface; because N-central is remote monitoring and management software run by managed service providers, such access can expose management functions across downstream customer environments. N-able N-central deployments are affected; the available data does not specify affected version ranges or fixed builds. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-04, confirming exploitation in the wild, with a high EPSS of 40.2% (99th percentile), no CVSS score yet, no public PoC, and undetermined ransomware use; related reporting describes a recent string of N-central hotfixes, including fixes for unauthenticated remote code execution.

Do: Apply N-able's hotfix for N-central immediately per the vendor's instructions, since the flaw is in CISA KEV and BOD 26-04 applies (for cloud-hosted N-central, apply mitigations per BOD 26-04 or discontinue use if mitigations are unavailable). Until patched, restrict internet exposure of the N-central server to trusted management networks and review authentication logs for unexpected access, following CISA's forensics triage guidance. Check the vendor advisory for the exact fixed build, as the available data does not list affected or fixed version numbers.

CVE-2026-18577 is an authentication bypass (CWE-288) in N-able's N-central RMM platform caused by an incomplete patch for the earlier vulnerability CVE-2026-18556. Because the original fix can be bypassed via an alternate path or channel, a remote, unauthenticated attacker needs no privileges or user interaction, though the attack requires meeting exploit-specific conditions (high attack complexity, CVSS 4.0: 8.2 High). Successful exploitation lets the attacker bypass authentication and take over N-central accounts, gaining high-impact access to the management console with limited direct effects on downstream services. All N-central versions through 2026.3.1 are affected. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2026-08-03, EPSS estimates a 54.1% chance of exploitation within 30 days (99th percentile), and news reports say attackers kept exploiting it even as N-able shipped successive hotfixes; ransomware use is currently unknown.

Do: Upgrade N-central to a fixed release or hotfix newer than 2026.3.1 following N-able's advisory — the vendor has issued multiple successive hotfixes for this and related N-central flaws, so verify you are on the latest build. Because the flaw is on CISA's KEV, federal and BOD 26-04-bound organizations must apply vendor mitigations promptly or discontinue use of the product if patching is unavailable. Limit internet exposure of N-central portals and review accounts for signs of takeover or unauthorized access.