12OCT

N-able hardens N-central as attackers pivot

2 min read

10:55UTC

N-able shipped a second hotfix for N-central on 6 August after watching attacker techniques change. Huntress saw intruders using the console's own remote-control feature to reach the endpoints it manages.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

N-able's second hotfix lands while attackers use N-central's own remote-control feature to reach managed customer endpoints.

N-able shipped Hotfix 2, build 2026.3.1.10, for N-central on 6 August, adding hardening after watching attacker techniques change⁠¹. N-central is remote monitoring and management software, known in the trade as RMM: the console a managed service provider uses to reach every customer endpoint it looks after. NHS England had alerted UK health organisations on 3 August, citing N-able, that attackers were exploiting CVE-2026-18577 to take over administrative accounts and obtain full administrative access to a server⁠².

That flaw is an incomplete fix for CVE-2026-18556, the earlier bug it was issued to close, and both carry a score of 8.2 under version 4 of the Common Vulnerability Scoring System⁠³. Huntress, a US security firm that watches managed endpoints for its customers, saw attackers use N-central's Take Control feature, the built-in remote-control tool an engineer uses to take over a desktop, to reach the machines the console administers, then run tunnels through Cloudflare's tunnelling service to keep their access⁠⁴. Cloudflare's product is being used as designed by people who should not have it, which is a different thing from Cloudflare being breached.

Australia's ACSC, the Australian Signals Directorate's Australian Cyber Security Centre, reported targeting inside Australia on 19 August and said it had no information pointing to any particular sector⁠⁵. Two of the three public warnings on this product therefore came from national bodies outside the United States, and both arrived before the vendor's second fix had a fortnight behind it.

Management consoles have been the recurring shape in the federal exploited-vulnerability record all summer, with wide-area network, firewall and management-plane products filling the catalogue in a single ten-day stretch at the end of July. An RMM platform cannot be patched quietly. Taking the console down interrupts monitoring for every customer estate attached to it at once, which is why the date on a second hotfix matters more than the fact of one.

Deep Analysis

In plain English

N-able makes N-central, software that IT companies use to remotely manage their clients' computers. Attackers found a way to abuse a legitimate feature of that software, called Take Control, to jump from one compromised network into others it manages. N-able released a hardening update on 6 August. Australia's cyber agency separately reported attacks using N-central there on 19 August, though it has not said which industry was hit.

Deep Analysis

Root Causes

RMM platforms like N-central exist specifically to give managed service providers privileged remote access into client networks, so any flaw in the platform inherits that same privileged reach for an attacker.

Tunnelling through Cloudflare's infrastructure, rather than a bespoke command server, lets malicious traffic hide inside legitimate CDN traffic that most network monitoring already allows through.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2021 Kaseya VSA breach used an almost identical structural weakness: remote monitoring and management software with privileged access to thousands of downstream networks, turned into a single pivot point for mass ransomware deployment.

Counter-parallel: N-able shipped hardening in a hotfix within weeks of NHS England's alert, rather than the days-long gap before Kaseya's REvil deployment, and there is no confirmed downstream ransomware payload yet in this case.

Consensus view: Huntress reports attackers are using N-central's own Take Control feature, the tool built for technicians to reach managed endpoints, to pivot onto customer networks and tunnel the traffic through Cloudflare's own infrastructure to blend in.

Counter-view: ASD's ACSC, reporting Australian targeting on 19 August, named no affected sector and stopped short of confirming the Cloudflare tunnelling technique domestically, leaving open whether the same operators are behind both sets of activity or two separate campaigns exploiting the same flaw.

Key tension: whether this is one actor working two regions or independent exploitation converging on the same vulnerable feature.

Sources:N-able·Huntress·Australian Signals Directorate's Australian Cyber Security Centre

Mentions:N-able →N-central →Huntress →Cloudflare →ASD →NHS England →England →Common Vulnerability Scoring System →United States →Australia →

First Reported In

Update #13 · Four privileged platforms under live attack

N-able· 5 Sept 2026

Read original →

Causes and effects

This Event

N-able hardens N-central as attackers pivot

An intruder holding a managed service provider's console does not need to move laterally, because the console already reaches everything.

Led to

PaperCut print servers under active attack

The same pattern of exploitation targeting management-plane software links the N-central and PaperCut chains this month.

Occurred 27 Aug 2026

Read story →

CISA flags N-central flaw as exploited

N-able's August hotfix during attacker pivoting preceded a further exploited N-central flaw in September.

Occurred 6 Sept 2026

Read story →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.