Critical N-able N-central Flaws Actively Exploited to Gain God-Mode Access to MSP Networks

N-able N-central has critical vulnerabilities (CVE-2026-18556 and a bypass CVE-2026-18577) that are being actively exploited to achieve unauthenticated administrative access to MSP consoles; N-able released hotfix 2026.3.1.7 and is urging immediate patching while Huntress has observed active abuse and published IOCs. The compromise enables attackers to push scripts, deploy tools, and open remote-control sessions across all managed endpoints, and many cloud-hosted servers remain unpatched; recommended mitigations include removing public access, enforcing MFA, limiting IP ranges, auditing accounts and sessions, or taking affected consoles offline until remediated.