Feds get 3 days to patch N-able God mode flaw under active exploit

security

Experts warn hotfix not optional. MSPs warned attacker gains ‘full administrative access to an N-central console’

The US Cybersecurity and Infrastructure Security Agency (CISA) has added an exploited N-able vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, giving federal agencies three days to patch a flaw that could let attackers reach managed service provider (MSP) customers.

Attackers exploiting the flaw can gain “full administrative access to an N-central console,” 

Tracked as CVE-2026-18577 (8.2 CVSSv4), N-able disclosed the vulnerability affecting N-central on Sunday, noting that it was exploited as of July 31.

MSPs use N-central to manage customer systems from a single dashboard, and successful exploitation can hand an attacker administrative access to the console.

Based on the limited set of partner logs it reviewed, security firm Huntress said successful attacks led to pivots into managed endpoints and the creation of Cloudflare-based tunnels for persistent access to victim networks.

“From an MSP perspective, exploitation of this flaw can grant an attacker full administrative access to an N-central console – the same level of control normally reserved for trusted NOC and engineering staff,” wrote Huntress’s Ben Bernstein and John Hammond.

Attackers can then open remote control sessions on critical systems and modify roles, accounts, and policies to support follow-on attacks.

The vulnerability affects N-central releases earlier than version 2026.3 when the server is exposed to the internet or reachable from an untrusted network.

Huntress advised customers unable to apply N-able’s hotfix immediately to disable N-central until they could do so.

Authorities elsewhere have also urged users to patch. NHS England’s advisory mentioned that its National Cybersecurity Operations Centre assessed that “further exploitation is likely,” while Belgium’s Centre for Cybersecurity urged fast action due to the “potential for significant impact.”

CVE-2026-18577 is related to an earlier flaw, CVE-2026-18556, patched in N-central 2026.2. According to N-able, that fix left another route to exploitation, which attackers began abusing late last month.

CISA gave Federal Civilian Executive Branch agencies until August 6 to remediate the flaw. Under Binding Operational Directive 26-04, CISA can impose a three-day deadline on vulnerabilities it considers an urgent risk rather than allowing the usual 14 days.

According to Huntress’s data, affected customers have leapt into action. By August 3, nearly all cloud-hosted N-central instances had been patched, although 28.6 percent of observed self-hosted servers remained vulnerable and exposed to the internet. ®