Your MSP's RMM Tool Has a Second Bypass Flaw

A Second Bypass, Not a New Bug

CVE-2026-18577 is an authentication bypass in N-able's N-central remote monitoring and management platform, the kind of flaw the Cybersecurity and Infrastructure Security Agency (CISA) classifies as a bypass using an alternate path or channel. It carries a CVSS score of 8.2, and what it hands an unauthenticated attacker is not a foothold but full administrative control of the N-central console itself.

What makes it worse is the history behind it. N-able had already patched an authentication-bypass flaw in N-central, tracked as CVE-2026-18556. CVE-2026-18577 is not a separate hole discovered later - it is a way around that same fix, a route into the console that the first patch left open. The vendor closed a door and left a window.

Inside a Compromised N-central Console

CISA and the security firm Rapid7 place active exploitation from 1 August 2026, days before N-able had a fix ready. Once inside a console, attackers reached for a feature N-central customers use every day: Take Control, the built-in remote-access tool MSPs rely on to reach the endpoints they manage. Instead of building their own access route, the intruders used the platform's own remote-control function to reach client machines directly.

For persistence, they deployed Cloudflare Tunnel, the cloudflared utility, to keep a quiet outbound connection open long after the initial break-in - the kind of channel that blends into ordinary encrypted traffic and does not need an inbound firewall rule to work. The threat-hunting firm Huntress reported watching this play out across multiple organizations, and N-able itself has acknowledged that a limited number of customers were compromised through CVE-2026-18577 before the hotfix shipped.

One Console, Many Companies' Networks

N-central is not endpoint software a single company installs on its own machines. It is the console a managed service provider uses to administer dozens or hundreds of client networks at once - patching, monitoring, remote access, all from one login. That is precisely what made this bypass worth automating for whoever found it: one authentication flaw, reachable by anyone who could see the console over the internet, sits upstream of every client an MSP touches through it.

Under the EU's NIS2 directive, an MSP that suffers an incident like this may owe a notification to its national authority - the UK equivalent, the National Cyber Security Centre (NCSC), publishes the same class of guidance for providers on its own side of the Channel. The obligation to report sits with the MSP. The exposure sits with every client whose network that console could reach, whether or not they ever heard the word N-central.

Applied Is Not the Same as Closed

N-able did not fail to patch. It patched CVE-2026-18556, shipped the fix, and moved on - and attackers still got back in through the same door by a different route. That is the uncomfortable lesson underneath the specifics: a vendor can apply a patch in good faith and still leave the underlying weakness intact, because the patch closed the path it tested, not the path someone else later found.

This is not an argument against patching, or a reason to distrust N-able specifically. It is a reminder that 'we patched it' and 'it is fixed' are two different claims, and only one of them is verifiable from outside the vendor. Owners who take the first claim as proof of the second - about this vendor or any other - are trusting a sentence instead of checking a version number.

The Question to Put to Your MSP This Week

N-able's fix is N-central 2026.3.1 Hotfix 1, shipped 2 August 2026. Hosted, cloud-managed N-central instances were updated automatically and need no action. On-premises deployments do not patch themselves - someone at the MSP has to apply the hotfix, and until they do, the console administering your network carries the same flaw CISA added to its Known Exploited Vulnerabilities catalog on 3 August, with US federal civilian agencies ordered to remediate by 6 August.

If your IT is outsourced, that deadline is not yours to meet, but it is a useful one to borrow. Ask your MSP directly whether the N-central console that touches your network is on 2026.3.1 Hotfix 1 or later, and ask for the build number, not a general assurance. A vendor relationship you cannot verify is not oversight - it is a hope you have outsourced along with the IT.

Read next: 45,601 Flaws This Year. 171 Are Being Used.  |  A Shared Certificate Is What Lets Qilin In