N-able's Patch Gap: How Attackers Slipped Past an Incomplete Fix

Robert Moore · 2026-08-03

When a security vendor tells you they've fixed a vulnerability, you expect the problem to be over. But N-able just proved that even well-intentioned patches can leave doors wide open. The company recently disclosed that attackers exploited an authentication bypass in N-central, its remote monitoring and management (RMM) platform, to gain remote administrative access and reach customer systems managed through those very servers. The scary part? Their first fix didn't actually fix anything. It was incomplete, leaving the vulnerability exposed for anyone clever enough to find it. And in the world of cybersecurity, that's not a matter of if—it's a matter of when. ### What Actually Happened N-able's disclosure centers on CVE-2026-18577, a critical authentication bypass vulnerability that affects N-central builds prior to 2026.3.1.7. In plain English, this flaw allowed attackers to bypass the normal login process and gain administrative privileges without proper credentials. Once they had that level of access, they could move laterally through the environment and reach the customer systems that N-central was supposed to protect. This is the nightmare scenario for any managed service provider (MSP). You're not just defending your own infrastructure—you're defending every client who trusts you with their network. When an RMM tool gets compromised, it's like handing the keys to every locked door in the building. ### The Incomplete Patch Problem Here's where things get interesting. N-able initially shipped a fix, but it didn't cover all the attack vectors. The patch was incomplete, which meant the vulnerability persisted in certain scenarios. It wasn't until build 2026.3.1.7, released on August 2, that the company delivered what it considers the first truly unaffected version. This isn't just a technical hiccup—it's a lesson in patch management. Too often, organizations assume that once a vendor releases a security update, they're safe. But if that update doesn't address every angle of the attack, you're still exposed. The takeaway? Always verify that patches are comprehensive, and don't stop monitoring just because an update has been applied. ### Why RMM Platforms Are Prime Targets N-central isn't just any software. It's a remote monitoring and management platform, which means it has deep access to the systems it manages. Attackers love these tools because they offer a single point of entry to multiple targets. Compromise one RMM server, and you potentially control dozens or hundreds of customer environments. This is why the stakes are so high. An authentication bypass in N-central isn't just a nuisance—it's a potential gateway to widespread data breaches, ransomware deployments, and prolonged network intrusions. For MSPs, the consequences can be devastating, both financially and reputationally. ### What Should You Do Now? If you're using N-central, here's your action plan: - **Update immediately**: Ensure you're running build 2026.3.1.7 or later. Don't delay—every day you wait is another day attackers have to exploit the flaw. - **Review your logs**: Look for any suspicious activity, especially around authentication attempts and administrative access. If something looks off, investigate thoroughly. - **Change credentials**: Rotate all administrative passwords and API keys associated with your N-central instance. Assume that any exposed credentials are compromised. - **Audit your clients**: If you're an MSP, check the systems managed through N-central for signs of intrusion. Early detection can mean the difference between a minor incident and a full-blown breach. ### The Bigger Picture This incident highlights a broader truth about cybersecurity: no patch is perfect, and no vendor is infallible. The best defense is a layered approach that combines timely updates, continuous monitoring, and a healthy dose of skepticism. Trust but verify—especially when it comes to security tools that hold the keys to your kingdom. N-able deserves credit for disclosing the issue and working toward a complete fix. But the real lesson here is for the rest of us. Don't assume you're safe just because a vendor says you are. Dig deeper, verify the fix, and always have a backup plan. In the world of cybersecurity, complacency is the enemy.