N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete

N-able's N-central servers were taken over by attackers who exploited an authentication bypass vulnerability to gain remote administrative access. The attackers were able to reach customer systems managed through those servers. The issue, identified as CVE-2026-18577, affects N-central builds prior to 2026.3.1.7. N-able initially released a fix, but it was incomplete, allowing the attacks to continue. A new build, 2026.3.1.7, was shipped on August 2, which is the first version not affected by the vulnerability. This vulnerability impacts the N-central remote monitoring and management platform.