N-able N-central Critical Authentication Bypass and RCE

N-able has disclosed a series of critical vulnerabilities impacting its N-central remote monitoring and management (RMM) platform, including a pre-authentication remote code execution (RCE) flaw (CVE-2026-86218) with a maximum CVSS score of 10.0. These flaws allow unauthenticated attackers to gain administrative access to N-central servers. The vulnerability sequence began with CVE-2026-18556 and CVE-2026-18577 in early August 2026, followed by a second wave of distinct flaws (CVE-2026-86206 and CVE-2026-86207) identified in September.

Technical analysis shows threat actors leveraging this access to pivot into managed customer environments using the platform's 'Take Control' feature. Once inside downstream systems, attackers establish persistence by registering Cloudflare tunnels as legitimate services, enabling long-term access even after the primary N-central management path is severed. This campaign represents a 'one-to-many' threat, where a single MSP compromise facilitates lateral movement into hundreds of client organizations.

This incident mirrors major supply chain attacks like the 2021 Kaseya breach. The blast radius for an RMM compromise is exceptionally high, as it grants attackers native capability to execute scripts, deploy tools, and access critical servers like domain controllers across an entire client base. CISA has added several of these flaws to the Known Exploited Vulnerabilities (KEV) catalog due to active exploitation.