Executive Summary
In July and August 2026, a critical security incident involving the N-able N-central remote monitoring and management (RMM) platform was disclosed, with attackers successfully compromising servers after an initial vendor fix proved incomplete. The vulnerabilities, tracked as CVE-2026-18556 and the subsequent CVE-2026-18577, enabled unauthenticated remote attackers to gain full administrative access to the N-central console. This access allowed adversaries to take over managed endpoints, deploy persistence mechanisms, and move laterally within victim environments. Despite a rapid hotfix release, the incomplete remediation left a secondary exploit path open, resulting in confirmed exploitation in the wild. Attackers leveraged VPN exit nodes and abused the built-in Take Control feature for stealthy lateral movement and persistence. This incident underscores the criticality of robust patch management, vigilant monitoring, and layered access controls for all organizations relying on RMM platforms.
Threat Actor Profile
Attribution for this campaign remains unconfirmed, with no direct linkage to a known Advanced Persistent Threat (APT) or ransomware group as of this report. However, the tactics, techniques, and procedures (TTPs) observed are consistent with those employed by sophisticated ransomware operators and initial access brokers who target Managed Service Providers (MSPs) and their downstream clients. The attackers demonstrated operational security awareness by routing their activity through commercial VPN services such as Mullvad and NordVPN, complicating attribution and detection. The use of dual-use tools, abuse of legitimate support accounts, and deployment of persistence mechanisms such as Cloudflare tunnels further indicate a high level of technical proficiency and a focus on stealth and persistence.
Technical Analysis of Malware/TTPs
The initial vulnerability, CVE-2026-18556, was an authentication bypass flaw in the N-able N-central platform, allowing unauthenticated attackers to obtain administrative privileges on the RMM console. The vendor’s first hotfix, released on August 2, 2026, addressed the primary exploit vector but failed to close an alternate path, leading to the assignment of CVE-2026-18577. Attackers exploited this incomplete fix to maintain access to vulnerable servers.
Upon gaining access, adversaries abused the Take Control feature to interact with managed endpoints, including domain controllers and critical infrastructure. They established persistence by deploying Cloudflare-based tunnels, often registering these as Windows services (e.g., a service named Cloudflared), which enabled outbound-only, encrypted connections that survived system reboots and bypassed traditional firewall controls. Attackers also leveraged dual-use tools and custom scripts to enumerate running processes, deploy additional payloads, and facilitate lateral movement.
Operational security was maintained by routing malicious traffic through VPN exit nodes, including IP addresses associated with Mullvad and NordVPN. Malicious infrastructure included domains such as mousears.synology[.]me, wagoosh.direct.quickconnect[.]to, and who-ripped-one.direct.quickconnect[.]to. Endpoint artifacts included suspicious executables (e.g., svchost.exe in user Documents folders), logs in C:\ProgramData\GetSupportService_N-Central\Logs\BASupSrvc_*.log.gz, and anomalous entries in the ui_access_control.log file, particularly those involving support accounts like mspsupport@n-able.com.
The MITRE ATT&CK techniques observed in this campaign include T1078 (Valid Accounts), T1021 (Remote Services), T1569 (System Services), T1571 (Non-Standard Port), and T1071 (Application Layer Protocol).
Exploitation in the Wild
Active exploitation of the N-central vulnerabilities was confirmed by both N-able and third-party security researchers, including Huntress. At least one Huntress customer was compromised, with attackers accessing nine organizations under a single partner account. Over 55% of reachable cloud servers remained unpatched several days after the hotfix release, highlighting the challenges of rapid patch deployment in complex MSP environments.
Attackers used a range of VPN exit node IPs, including 173.249.252[.]200, 87.249.138[.]34, 37.19.210[.]32, 68.235.46[.]214, 37.153.90[.]88, and 92.118.112[.]181. Malicious domains observed in the campaign included mousears.synology[.]me, wagoosh.direct.quickconnect[.]to, and who-ripped-one.direct.quickconnect[.]to. The attackers’ ability to pivot from the RMM console to managed endpoints, deploy persistence, and evade detection underscores the severity of the incident.
Victimology and Targeting
The primary targets of this campaign were organizations utilizing the N-able N-central platform, with a particular focus on Managed Service Providers (MSPs), IT service providers, and their downstream customers. Affected sectors include education, financial services, state and local government, healthcare, law firms, manufacturing, and utilities. The global footprint of N-central deployments means that organizations across multiple geographies were at risk. The attackers’ use of the RMM platform as a force multiplier enabled them to compromise not only the MSPs themselves but also the myriad client environments managed through these platforms.
Mitigation and Countermeasures
Immediate action is required for all organizations running N-central. The following steps are recommended:
Upgrade all N-central servers to version 2026.3.1.7 or later, as this is the first build unaffected by both CVE-2026-18556 and CVE-2026-18577. Restrict access to the N-central console to trusted IP addresses and networks only, leveraging network segmentation and firewall rules. Conduct a comprehensive review of all N-central logins, with particular attention to sessions originating from the identified IOC IPs and support accounts such as mspsupport@n-able.com. Investigate all remote-control sessions, especially those targeting domain controllers and other critical infrastructure. Hunt for endpoint artifacts, including suspicious services (e.g., Cloudflared), anomalous executables, and logs indicating unauthorized access or persistence mechanisms. Monitor network traffic for connections to the listed malicious IPs and domains, and block these at the perimeter where possible. Implement enhanced monitoring and alerting for unusual activity within the RMM platform, including after-hours access, privilege escalation, and mass deployment of scripts or tools.
Long-term, organizations should enforce least-privilege access, implement multi-factor authentication for all administrative accounts, and regularly audit RMM platform configurations and access logs. Consider deploying endpoint detection and response (EDR) solutions capable of detecting dual-use tool abuse and persistence mechanisms such as outbound tunnels.
References
Huntress Rapid Response: Critical N-able N-central Vulnerability and Active Exploitation: https://www.huntress.com/blog/n-able-vulnerability-exploitation
N-able Security Update (August 1, 2026): https://www.n-able.com/blog/n-central-security-update-august-1-2026
CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Reddit: Emergency Patching Announcement - N-Central: https://www.reddit.com/r/msp/comments/1vddfp3/emergency_patching_announcement_ncentral/
The Hacker News Facebook Post: https://www.facebook.com/thehackernews/posts/-attackers-took-over-n-central-serversn-able-says-they-reached-customer-endpoint/1438025568362022/
About Rescana
Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their extended supply chain. Our advanced analytics and threat intelligence capabilities empower security teams to proactively identify vulnerabilities, prioritize remediation, and ensure compliance with industry standards. For more information about how Rescana can help safeguard your organization’s digital ecosystem, we are happy to answer questions at info@rescana.com.
