CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild.

The vulnerability, tracked as CVE-2026-18577 (CVSS score: 8.2), is a case of incomplete patching for CVE-2026-18556 (CVSS score: 8.2) that allows authentication bypass and account takeover in susceptible versions of the software. The issue has been addressed in version 2026.3 HF1.

“N-able N-central contains an authentication bypass using an alternate path or channel [that] allows for authentication bypass and account takeover in N-central,” CISA said.

Successful exploitation of the vulnerability can permit remote attackers to gain administrative access to vulnerable N-central servers and then abuse the built-in Take Control feature to pivot into managed endpoints and deploy persistence mechanisms.

N-able has shared the following indicators of compromise –

• Review device users’ documents folder for a file called “svchost.exe,” as well as look for a registered service name called “Cloudflared,” a legitimate tunneling utility from Cloudflare that’s frequently abused by bad actors to set up covert, outbound connections and disguise malicious operations as legitimate traffic.
• Scan for inbound connections from any of the below IP addresses –
  • 173.249.252[.]200
  • 87.249.138[.]34
  • 37.19.210[.]32
  • 68.235.46[.]214

The malicious activity has not been publicly attributed to any known threat actor or group. However, Huntress said it observed threat actors targeting the flaw across multiple organizations. There is no indication that it has turned into a broad, indiscriminate campaign at this stage.

Some of the patterns observed post successful exploitation include –

• Conducting high-level reconnaissance to target key servers, such as domain controllers
• Enumerating running processes on a compromised host before disconnecting
• Moving laterally to other hosts in impacted organizations’ environments after gaining initial access

In at least one case, the threat actor has been found making a malicious connection via “MSP Support,” a default username tied to legitimate N-Central Take Control sessions, from the IP address “173.249.252[.]200.” All the aforementioned four IP addresses are Mullvad or NordVPN VPN exit nodes.