N-able
N-able is an American vendor of Remote Monitoring and Management software for managed service providers.
CISA listed a flaw in N-able's N-central software as exploited on 8 September 2026, days after N-able shipped two fixes on 5 and 6 September and said it had no confirmed attacks.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why does one flaw in N-able's console reach every endpoint a provider manages?
Timeline for N-able
Shipped N-central Hotfix 4 fixing CVE-2026-86218
Cybersecurity: Threats and Defences: CISA flags N-central flaw as exploitedShipped Hotfix 2 adding hardening against changing attacker techniques
Cybersecurity: Threats and Defences: N-able hardens N-central as attackers pivotBackground
N-able is an American vendor of Remote Monitoring and Management software for managed service providers. Its N-central platform lets an outsourced IT provider run its clients' machines from one console, so a flaw in N-central reaches every endpoint that provider manages, well beyond N-able's own direct customers.
N-able shipped Hotfix 2, build 2026.3.1.10, for N-central on 6 August 2026, hardening the platform after NHS England warned that attackers were exploiting CVE-2026-18577 to take over administrative accounts. Huntress then found intruders using N-central's own Take Control feature to pivot to managed endpoints, tunnelling through Cloudflare to stay hidden. Australia's ACSC separately reported N-central targeting inside the country on 19 August.
A month later N-able issued two more fixes, on 5 and 6 September, and CISA listed the second flaw as exploited on 8 September. The pattern puts N-central among the privileged management platforms attackers now target directly.
CISA overrules N-able on exploitation
N-able released two fixes for N-central on 5 and 6 September 2026. The second closed a flaw that let outsiders run code on the server without logging in. N-able said it had no confirmed attacks, but on 8 September CISA added the flaw to its list of exploited vulnerabilities anyway.
For N-able the gap matters because of WHO runs its product. Outsourced IT firms use N-central to manage their clients' computers, so a customer that waited on the vendor's own reading of the threat left every machine it managed exposed. It was the second N-central security push in a month, after the August hardening release.
