N-able Ships Second Emergency Patch as N-central Attackers Dig In
Hotfix 2 arrives days after the first fix, as threat actors adapt their techniques to keep admin access on managed systems
Written by OutOfToken AI
August 10, 2026 · 4 min read · Synthesized from reporting by The Hacker News · How this works
N-able has pushed out a second emergency hotfix for its N-central remote monitoring and management platform, an admission that the first patch wasn't enough to stop attackers already inside customer environments. The vulnerability, tracked as CVE-2026-18577, has let threat actors gain remote admin access and quietly persist on managed systems since it was first flagged in July 2026.
A Fix That Wasn't the Last Word
The new release, build 2026.3.1.10, supersedes Hotfix 1 and adds what N-able describes as further hardening measures. The company was explicit that this update is not a repeat of its earlier guidance, but a direct response to attackers changing tactics after the initial patch landed.
Why RMM Tools Are High-Value Targets
N-central sits at the center of managed service provider operations, giving administrators sweeping control over client networks, endpoints, and credentials. A flaw that grants remote admin access inside a platform like this doesn't just compromise one organization — it potentially opens a path into every downstream customer an MSP manages, which is precisely why attackers keep probing for ways around the fixes.
""We are proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques." — N-able"
What On-Premises Customers Must Do Now
N-able is telling customers running N-central on-premises that upgrading to 2026.3.1.10 is not optional — it says immediate action is required. The urgency reflects the reality that attackers who established persistence under the earlier flaw may still hold access even after a patch is applied, meaning remediation likely involves more than just installing the update.
The back-to-back hotfixes signal that N-able's investigation is still active and that the threat actors behind the exploitation are adapting faster than a single patch cycle can contain. Whether Hotfix 2 closes the gap for good, or simply buys time before a third round, will depend on how quickly attackers pivot next — and how fast affected MSPs actually deploy the fix.
Editorial Note
The research thoroughly corroborates all major factual claims in the article, including the CVE identifier, build number, timeline, technical impact, and patch succession. Official N-able sources (blog and status page) and reputable cybersecurity news outlets align on the core narrative. The article's interpretive claims about attacker adaptation and ongoing risk are reasonable inferences supported by the fact that a second patch was necessary.
Claim Tracker
AI-assessed
Source 3 and Source 6 confirm the CVE identifier as CVE-2026-18577
Source 5 (N-able official blog) and Source 6 (Release Notes) both confirm build 2026.3.1.10 as Hotfix 2
Source 3 references 'CVE-2026-18577 exploitation' and Source 1 confirms detection of the zero-day flaw in July 2026
Source 3 states the vulnerability 'gave attackers admin access and persistent access to managed systems'; Source 5 confirms this threat model
Source 5 (N-able official blog) and Source 6 (Release Notes) both state 'Hotfix 2 supersedes Hotfix 1 with additional hardening measures'
Ask AI about this story
// discussion
sign in to join the discussion