Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using N-able N-central RMM
Incident: Active exploitation of an authentication bypass vulnerability (CVE-2026-18577) in N-able N-central.
Impact: Full administrative account takeover and unauthorized lateral movement to all managed endpoints.
Attacker: Unidentified threat actors
Analysis: The vulnerability CVE-2026-18577 allows attackers to bypass authentication and take over accounts, providing a direct foothold in the RMM server. From there, adversaries use the built-in ‘Take Control’ feature to move laterally into managed endpoints and deploy persistence. The use of VPN exit nodes and the Cloudflared utility helps mask malicious outbound traffic as legitimate.
Recommendations: Update N-central to version 2026.3 HF1 immediately; Audit ‘Take Control’ session logs for unauthorized or anomalous activity; Monitor for ‘svchost.exe’ in user documents and unauthorized ‘Cloudflared’ services
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-08 07:52 UTC
Active exploitation of a zero-day authentication bypass vulnerability in N-able N-central. Full administrative takeover of the RMM server and subsequent persistence on managed client endpoints. Threat actors are exploiting an authentication bypass vulnerability (CVE-2026-18577) to gain remote administrative access to N-central servers. Once inside, they utilize the ‘Take Control’ feature to pivot into managed endpoints and deploy Cloudflare Tunnels for long-term persistence. This attack chain ensures that attackers maintain access even after the primary server vulnerability is remediated.
Corroborating source: thehackernews.com
Update — 2026-08-10 18:07 UTC
Deployment of new StormEncryptor ransomware via N-central vulnerability exploitation. Unauthorized account takeover leading to data exfiltration and system-wide encryption. Storm-1175 has shifted from Medusa to a new C++ based ransomware known as StormEncryptor. The group is likely leveraging authentication bypass flaws in N-able N-central to gain initial access. Once inside, they utilize RMM tools and credential dumpers to rapidly move from entry to full-scale encryption.
Corroborating source: thehackernews.com