N-central
N-central is N-able's Remote Monitoring and Management console for managed service providers.
CISA listed an N-central flaw as exploited on 8 September 2026, days after N-able shipped two fixes for a bug that let outsiders run code on the server without logging in. It was the console's second attack wave since August.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why can one compromised N-central console reach every endpoint it manages?
Timeline for N-central
CISA flags N-central flaw as exploited
Cybersecurity: Threats and DefencesN-able hardens N-central as attackers pivot
Cybersecurity: Threats and DefencesBackground
N-central is N-able's Remote Monitoring and Management console. Managed service providers use it to run their clients' computers, so the console sits inside many customer networks at once and one working exploit can reach every client a provider serves.
The first 2026 wave came in August. NHS England warned on 3 August that attackers were exploiting CVE-2026-18577 to gain full administrative access, and N-able shipped a hardening update on 6 August. Huntress then found intruders abusing N-central's own Take Control feature to reach managed networks, hiding their traffic inside Cloudflare's services. Australia's ACSC reported separate targeting on 19 August and named no affected sector.
The second wave followed in September. N-able released fixes on 5 and 6 September, the second closing an unauthenticated Remote Code Execution flaw, and said it had no confirmed attacks. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalogue on 8 September regardless.
