Authentication bypass and account takeover in N-able N-central

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

The version boundary is not fully consistent between the initial record and later vendor follow-up:

• The structured affected facts mark N-central custom versions from 0 through 2026.3 as affected. The supplied CVE description extends exposure through 2026.3.1.
• N-able's initial notice identified instances not running 2026.3.1 as affected and provided Hotfix 1 build 2026.3.1.7.
• N-able's follow-up states that Hotfix 2 is required even when Hotfix 1 has already been applied. Build 2026.3.1.10 supersedes 2026.3.1.7 and is the vendor's current remediation for self-hosted deployments.
• N-able states that hosted N-central instances have had mitigations applied. The available evidence does not establish the status of every later or parallel release branch, so those branches should not be assumed to be unaffected.
• The normalized record gives default_status as unaffected outside the listed range, but the vendor follow-up does not independently confirm every branch outside that range.

N-able N-central contains an authentication bypass caused by an incomplete earlier patch that leaves an alternate authentication path, corresponding to CWE-288. The record confirms that the flaw can lead to account takeover; N-able describes observed exploitation that provided remote administrative access without authentication. After access was obtained, the threat actor used the Take Control feature to connect to managed devices and registered Cloudflare tunnel services to maintain persistence. The specific endpoint, request sequence, and code-level remediation remain undisclosed, so a more detailed exploit path cannot be confirmed. The confirmed affected scope is N-central, while managed endpoints may be impacted after administrative access is obtained.

• The flaw is reachable over the network and requires no authentication or user interaction; the normalized record characterizes attack complexity as high.
• The record identifies a public exploit and marks the vulnerability as known exploited.
• N-able reports that a threat actor exploited the issue to obtain remote administrative access without authentication and then used Take Control on managed devices.
• N-able has identified a limited number of impacted customers and states that its investigation remains ongoing.
• Complete exploit code, payloads, and the exploit sequence have not been disclosed.

Successful exploitation can bypass authentication and provide remote administrative access to N-central. Direct consequences include account takeover, unauthorized access, and administrative actions; the impact may extend to managed endpoints through Take Control. N-able describes persistence on endpoints through Cloudflare tunnel services, along with new account creation and password resets in impacted cases. The organizational scope is not established as universal, and the available evidence does not show that every deployment experienced loss of integrity or availability.

The primary confirmed consequence is remote administrative access to N-central without authentication and potential account takeover. With that access, an attacker may use Take Control to connect to managed devices, perform unauthorized endpoint actions, and establish persistence through Cloudflare tunnel services. N-able also reports creation of new users and password resets used to maintain access in impacted environments. The available evidence does not establish that every customer was compromised, nor does it confirm data theft or service disruption across all deployments.

1. For self-hosted N-central, upgrade to build 2026.3.1.10. This is Hotfix 2, supersedes 2026.3.1.7, and is required even if Hotfix 1 was already applied.
2. N-able lists direct upgrade paths to 2026.3.1.10 from 2025.4, 2026.1, 2026.2, 2026.3, and 2026.3.1 Hotfix 1. Older installations should first move to a supported intermediate build and then apply this hotfix.
3. For hosted N-central, N-able states that mitigation has already been applied and that no customer patching action is required. Environments with an exposure window should still be investigated for suspicious account and endpoint activity.
4. After upgrading, treat systems that were patched late as potentially compromised. Review users, privileges, logins, new accounts, password resets, Take Control activity, and unusual endpoint actions; applying the hotfix alone does not prove that an existing threat actor has been removed.
5. Enforce MFA across accounts and disable the in-product support account when it is not needed for an open support case. Contact N-able support and the internal security team if suspicious activity is found.

1. Inventory all N-central deployments, distinguish hosted from self-hosted instances, and verify each build against N-able's remediation guidance.
2. On managed Windows endpoints, inspect users' Documents directories for an unexpected svchost.exe file and check for a registered service named Cloudflared.
3. Review N-central and endpoint logs for suspicious logins, unexpected user creation, unexplained password resets, unusual Take Control activity, or unauthorized actions on managed endpoints.
4. Review firewall logs for traffic from 173[.]249[.]252[.]200, 185[.]156[.]46[.]150, 23[.]234[.]94[.]43, 37[.]153[.]90[.]88, 37[.]19[.]210[.]32, 68[.]235[.]46[.]214, 68[.]235[.]46[.]235, 87[.]249[.]138[.]34, and 92[.]118[.]112[.]181.
5. A vendor-provided IOC scan or custom service can be used as an additional check. A clean result does not prove that the environment was not impacted; review accounts, privileges, logs, and activity as well.