{"id":2292,"date":"2026-08-08T11:38:29","date_gmt":"2026-08-08T11:38:29","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2292"},"modified":"2026-08-08T11:38:29","modified_gmt":"2026-08-08T11:38:29","slug":"n-able-issues-n-central-hotfix-2-as-attackers-reach-managed-systems-and-persist","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2292","title":{"rendered":"N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 08, 2026<\/span><\/span>Vulnerability \/ Enterprise Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

N-able has released<\/a> a fresh round of hotfixes for N\u2011central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management (RMM) product.<\/p>\n

\u00abWe are proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques,\u00bb the company said.<\/p>\n

\u00abThis is not a duplicate of our previous communication. Hotfix 2<\/a> is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers.\u00bb<\/p>\n

The disclosure comes as N-able acknowledged that it detected unusual activity within a customer’s environment on July 31, 2026, leading to the discovery of unknown threat actors exploiting a then-zero-day flaw in the N\u2011central server (CVE-2026-18577, CVSS score: 8.2). It impacts all versions prior to 2026.3.1.7.<\/p>\n

It’s worth noting that CVE-2026-18577 relates to an incomplete fix for CVE-2026-18556 (CVSS score: 8.2). Both vulnerabilities, which allow authentication bypass and account takeover in susceptible versions, have been flagged as actively exploited by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

In the attacks observed by N-able, the vulnerability allowed the attackers to obtain administrative access remotely and then leverage the Take Control feature to connect to systems within the N\u2011central managed environment. Upon gaining access to those devices, the threat actors registered a new service for a Cloudflare Tunnel, enabling persistence even after access to the N\u2011central server was revoked.<\/p>\n

N-able has confirmed that a limited number of customers have been affected by the exploitation activity. Customers running an on-premise version are advised to update their instances to 026.3.1.10 immediately. The company has also shared an expanded set of IP addresses as indicators of compromise (IoCs) –<\/p>\n