Remote Management and Monitoring Tools Widely Used by Managed Security Providers
N-Able, a prominent remote management and monitoring software firm, recently confirmed that attackers are actively exploiting vulnerabilities across all versions of its N-central software. This alarming revelation has raised significant concerns among managed security providers (MSPs) who rely on N-Able’s tools to oversee their customers’ computing environments.
In response to the escalating situation, the Burlington, Massachusetts-based company issued an emergency hotfix on Monday. This action followed a previous patch released over the weekend that failed to fully mitigate the vulnerability being exploited.
N-Able’s RMM tool has become a staple for MSPs as it allows them to manage their clients’ systems effectively. However, the implications of potential compromises extend far beyond individual MSPs, as threats to a single provider could lead to attacks on hundreds or even thousands of downstream systems. The cascading effect of these breaches underscores the vulnerability inherent in centralized management solutions.
Initially, N-Able assessed that the attacks were confined exclusively to on-premises servers running outdated versions like v2026.1, due to authentication bypass vulnerabilities tracked as CVE-2026-18556. However, that assessment soon proved overly optimistic. The company revised its position, acknowledging that both cloud and on-premises versions of N-Able across regions including the Americas, APAC, and Europe were being exploited.
The urgent hotfix release, version 2026.3.1.7, was made available on Sunday, addressing an additional vulnerability identified as CVE-2026-18577. The accompanying release notes highlighted that an incomplete patch for CVE-2026-18556 was allowing continued exploitation of N-central, putting countless organizations at risk.
N-Able’s urgent call to action stressed that organizations using on-premises versions of N-central must install the patch immediately. For cloud-based instances, N-Able began rolling out the hotfix as quickly as possible. However, the cybersecurity community, particularly cybersecurity firm Huntress, noted a significant lag in patch adoption. They reported that 56% of their partners and customers’ cloud instances of N-central had not yet applied the necessary fixes, a situation that raised red flags due to the custom distribution of AlmaLinux 9 employed by the N-able server, which typically does not run EDR (endpoint detection and response) software.
The implications of having unpatched RMM software are severe. With direct access to this software, attackers could attain administrator-level privileges, enabling them to deploy malware such as cryptolockers, which have devastating effects on businesses by encrypting essential data. According to Huntress, these remote attackers leverage the Take Control feature of N-central servers to pivot into managed endpoints and create persistent backdoors into compromised networks using Cloudflare-based tunnels.
The nature of RMM software makes it an attractive target for cybercriminals, particularly ransomware groups. Ian Thornton-Trump, CISO of cybersecurity firm and MSP Inversion6, referred to the ease with which RMM solutions can enable large-scale attacks, asserting that a single compromise can lead to numerous downstream breaches, which is a scenario that cybercriminals find irresistible.
Historically, such vulnerabilities can lead to catastrophic events; one notable instance occurred in July 2021, when ransomware group REvil executed a devastating supply-chain attack that targeted Kaseya’s VSA software. This exploit granted the attackers remote access to up to 1,500 businesses globally, leading to rampant crypto-locking and chaos, demanding a $70 million ransom from Kaseya in exchange for a universal decryptor.
Given N-able’s extensive install base, Thornton-Trump warned that this situation could escalate into a Kaseya-like incident if controlled measures are not implemented promptly, emphasizing that MSPs should temporarily go offline or block access until they have the necessary patches in place.
The events took a turn on Friday when N-able suspected its software was under attack upon noticing an unusual increase in licensing issues among on-premises N-central customers. This prompted the company to investigate further, leading them to discover that attackers had leveraged an existing vulnerability in N-central servers running outdated versions to gain remote administrative access. Following exploitation, these attackers exploited the Take Control feature, registering a new service for a Cloudflare tunnel to maintain access even after the initial breach had been addressed.
In light of these developments, the fallout from the attack has proven to be more serious than N-able initially anticipated. Their primary security alert on Saturday downplayed the scope of the breach, claiming that only a limited number of customers were impacted. However, by Sunday, the company issued a revised statement indicating that all versions of N-central prior to 2026.3 were vulnerable and insisted that all customers upgrade to version 2026.3.1.7 without delay. Additionally, N-Able provided indicators of compromise, including IP addresses related to the attacks, to assist organizations in detecting potential breaches.
To mitigate risk further, Huntress advised that users of N-able’s software rigorously scrutinize N-central server logs and Windows hosts for suspicious activity associated with Take Control and to review network telemetry for any communications involving the designated IP addresses and hostnames identified in the incident.