N-able N-central authentication bypass used to reach managed customer networks
N-able said attackers exploited CVE-2026-18577, an N-central flaw that gives an unauthenticated attacker administrative access, after its Adlumin service flagged suspicious activity at a customer on July 31, 2026. Attackers used N-central's Take Control feature to connect to systems in managed environments and registered Cloudflare Tunnel services to keep access; N-able said the first hotfix was incomplete and shipped a second on August 7.
- Victim
- Multiple: N-able N-central on-premises customers (a limited number, per N-able)
- Industry
- Technology
- Country
- Global
- Intrusion began
- Jul 31, 2026
- First disclosed
- Aug 3, 2026
- Actor
- Unattributed
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Authentication
- MFA
- Not applicable (no interactive login)
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
An RMM console that skipped authentication handed out admin access to every managed endpoint. RMM management planes need to be off the internet and behind phishing-resistant MFA, with alerts on new remote sessions.
Go deeper on SWI
- Vulnerability: N-able N-central auth bypass, incomplete patch of CVE-2026-18556
- SWI coverage: n able n central auth bypass first fix incomplete
- SWI coverage: n able n central god mode flaw reached customer networks
Sources
- N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete, The Hacker News, Aug 3, 2026
- N-able God mode flaw: Vendor confirms attackers reached customer networks as second hotfix lands, The Register, Aug 7, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- SimpleHelp RMM OIDC token forgery exploited for technician access 2026 · Identity infrastructure vulnerability
- FortiWeb authentication bypass exploited to create rogue admin accounts 2025 · Identity infrastructure vulnerability
- BeyondTrust Remote Support zero-day used to dump the appliance credential vault 2026 · Identity infrastructure vulnerability
- Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). N-able N-central authentication bypass used to reach managed customer networks. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-n-able-n-central-auth-bypass/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.