Attackers Exploit N-able Patch Bypass Flaw on RMM Servers

N-able disclosed active exploitation of a patch-bypass/authentication vulnerability in its N-central RMM product (tracked as CVE-2026-18577, CVSS 8.2) that allowed attackers to obtain administrative access, leverage the "Take Control" feature to pivot into managed environments (including domain controllers), and persist via a Cloudflare tunnel. The vendor released a fix (2026.3.1.7) and urged upgrades; telemetry shows limited confirmed victims but a large potential blast radius for unpatched, self-hosted servers, and Huntress published IOCs and hardening recommendations.