# N-able N-central Authentication Bypass Flaws (CVE-2026-18556, CVE-2026-18577) Actively Exploited for Admin Access and Cloudflare Tunnel Persistence

> N-able released a second hotfix (build 2026.3.1.10) for its N-central RMM platform after threat actors actively exploited two related authentication-bypass/account-takeover vulnerabilities (CWE-288) to gain unauthenticated administrative access and establish Cloudflare Tunnel persistence on managed endpoints. CVE-2026-18577 is an incomplete fix for the earlier CVE-2026-18556; both are CISA KEV-listed as actively exploited, with Huntress observing one compromised self-hosted partner account reach nine downstream organizations.

- **Published:** 2026-08-08T00:00:00Z
- **Last reviewed:** 2026-08-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1941
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-n-central-cloudflare-tunnel-persistence-tl-2026-1941.webp?v=1918b8e8 (Threadlinqs threat intel: CVE-2026-18556 N-central Cloudflare Tunnel: Detection & IOCs (TL-2026-1941) — High severity, 35 IOCs, 9 detection rules.)
- **ID:** TL-2026-1941
- **Severity:** HIGH (CVSS 8.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 35 (3 shown free below)
- **CVEs:** CVE-2026-18556, CVE-2026-18577

## Description

N-able's N-central remote monitoring and management (RMM) platform, used by managed service providers (MSPs) and enterprise IT teams to administer downstream customer environments, contains two related authentication-bypass vulnerabilities (CWE-288, Authentication Bypass Using an Alternate Path or Channel) enabling unauthenticated administrative account takeover. CVE-2026-18556 (CVSS 3.1 7.4 -- AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N -- / CVSS 4.0 8.2) affected all N-central versions through 2026.1 and was addressed by an initial vendor patch in build 2026.2. That patch proved incomplete: CVE-2026-18577 (CVSS 2.0 7.6 / CVSS 3.1 8.1 -- AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H -- / CVSS 4.0 8.2) is a residual flaw affecting all N-central versions prior to build 2026.3.1.7, letting attackers route around the earlier fix via an alternate exploitation path and again obtain full, unauthenticated administrative access remotely -- both on cloud-hosted (NCOD) and on-premises deployments, described by researchers as effectively "trivial to exploit."

N-able first detected the activity on July 31, 2026 as a spike in anomalous licensing errors reported by on-premises customers, traced via its Adlumin MDR service to active exploitation of what would be designated CVE-2026-18577. On August 2, 2026 the vendor shipped Hotfix 1 (build 2026.3.1.7) and published its first advisory; Finland's national cyber security centre also issued a notice the same day. Huntress published a rapid-response writeup on August 3 confirming exploitation across multiple organizations -- in at least one case a single compromised self-hosted MSP partner account was used to reach nine downstream client organizations, one endpoint compromised per organization -- and found that as of 12:45 AM ET on August 3, 55.6% of internet-reachable cloud (NCOD) N-central servers were still unpatched; a subsequent same-day Huntress update reported patch compliance improving to 13.6% of internet-reachable cloud servers and 28.6% of self-hosted instances still unpatched/vulnerable. CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities (KEV) catalog on August 3, 2026 (remediation due August 6) and CVE-2026-18556 on August 4, 2026 (remediation due August 7), directing federal civilian agencies to remediate under Binding Operational Directive 22-01. Sophos independently identified a compromised customer in its telemetry at approximately 08:00 UTC on August 3, and a second compromised organization on August 5. Continued monitoring of threat-actor behavior showed Hotfix 1's hardening was insufficient, and on August 6, 2026 N-able shipped Hotfix 2 (build 2026.3.1.10), stating explicitly it was required even for customers who had already applied Hotfix 1, alongside an expanded 10-IP indicator list and a downloadable IOC-detection service template for Windows endpoints.

Post-exploitation, attackers used unauthenticated administrative access to the N-central console to invoke the built-in Take Control remote-access feature and pivot into managed downstream endpoints, deliberately targeting high-value systems -- domain controllers, backup servers, and application servers -- rather than opportunistic access, effectively abusing the trusted MSP-to-client management channel itself as the lateral-movement path. Sophos telemetry documented attackers running "net user" and "net user /domain" account-enumeration commands, creating a new rogue domain account named "veeam," and resetting existing administrator passwords (account manipulation/persistence), then running reconnaissance commands "nltest /dclist" (domain-controller enumeration) and "net group \"domain admins\" /domain" (domain-admin group enumeration). Attackers piped "tasklist" output through "findstr ms" and "findstr soph" to specifically fingerprint running Microsoft Defender and Sophos agents, then used a Bring-Your-Own-Vulnerable-Driver-style EDR-evasion tool dubbed "PhantomKiller" (also observed renamed to 9.exe) -- which loaded a kernel driver (k.sys) staged inside C:\ProgramData\AnyDesk -- to terminate the Sophos File Scanner process (sophosfilescanner.exe) and impair endpoint defenses; Sophos tracks detection for this activity internally as CXmal/KillAV-BR. For persistence, actors registered a new Windows service to run a Cloudflare Tunnel (cloudflared), masquerading the binary under names such as "MicrosoftEdgeUpdate64.exe" and "msmp.exe" to blend in with legitimate Windows/Edge update processes; this gave them an outbound, firewall-evading channel that survived revocation of their access to the N-central server itself. Huntress and Sophos additionally observed a wide sprawl of legitimate commercial remote-access tools installed across compromised endpoints for redundant access -- AnyDesk, TeamViewer (via TeamViewer_Setup.exe / team.msi), RustDesk, SimpleHelp (service64off.exe), HopToDesk, and a rogue TacticalRMM v2.11.0 agent deployed via a PowerShell installer script (install_server.ps1) that dropped tacticalagent-v2.11.0-windows-amd64.exe, phoning home to attacker infrastructure at api.mendoratech.health. A suspicious svchost.exe binary was also found planted in a user's Documents folder, masquerading as a legitimate Windows process outside its expected System32 location. Disclosed indicators include ten IP addresses and three .synology.me/quickconnect.to domains, several of the IPs resolving to Mullvad and NordVPN commercial VPN exit nodes, consistent with deliberate origin obfuscation; one of the Mullvad-associated IPs had prior history of abuse for brute-forcing and spam. No public attribution to a specific threat actor or group has been made. N-able has stated a limited but unspecified number of customers were affected, and the incident is being cited by third-party analysts as an illustration of RMM/MSP platforms' outsized supply-chain blast radius -- a single authentication-bypass exploit against one MSP's management server can cascade into intrusions across every downstream client it manages.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1543.003 Windows Service
- T1136.002 Domain Account
- T1098 Account Manipulation
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1057 Process Discovery
- T1018 Remote System Discovery
- T1069.002 Domain Groups
- T1518.001 Security Software Discovery
- T1087.002 Domain Account
- T1059.001 PowerShell
- T1570 Lateral Tool Transfer
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1090 Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Rogue Cloudflare Tunnel Service Masquerading as MicrosoftEdgeUpdate64.exe / msmp.exe** (`TL-2026-1941-SPL-003`)

Detects registration of a new Windows service running cloudflared (Cloudflare Tunnel) under a masqueraded binary name (MicrosoftEdgeUpdate64.exe, msmp.exe) outside the legitimate Edge installation path — the confirmed persistence mechanism that survived revocation of the attackers' N-central access, giving them a firewall-evading outbound C2 channel.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1543.003, T1572, T1036.005
- **Data sources:** windows_security, sysmon, service_control_manager
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=wineventlog sourcetype="WinEventLog:System" EventCode=7045
(ImagePath="*cloudflared*" OR ImagePath="*MicrosoftEdgeUpdate64.exe*" OR ImagePath="*msmp.exe*")
NOT ImagePath="*\\Program Files (x86)\\Microsoft\\Edge*"
| table _time Computer_Name Service_Name ImagePath Account_Name
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (ProcessCommandLine has "cloudflared" or FileName in~ ("MicrosoftEdgeUpdate64.exe","msmp.exe"))
| where FolderPath !startswith @"C:\Program Files (x86)\Microsoft\Edge"
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessAccountName
```

### Sigma

```yaml
title: Cloudflare Tunnel Service Registered Under Masqueraded Microsoft Edge Update Binary Name
id: 7a1e2f3c-4b5d-4e6f-8a9b-1c2d3e4f5a07
status: experimental
description: Detects a new Windows service whose ImagePath references cloudflared or the masqueraded names MicrosoftEdgeUpdate64.exe/msmp.exe outside the legitimate Microsoft Edge install directory — the confirmed cloudflared persistence mechanism observed post N-central compromise.
references:
  - https://thehackernews.com/2026/08/n-central-attackers-reach-managed.html
  - https://www.sophos.com/en-us/blog/nable-ncentral-exploitation-results-in-rmm-tool-deployment
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-08
tags:
  - attack.persistence
  - attack.command-and-control
  - attack.t1543.003
  - attack.t1572
  - attack.t1036.005
logsource:
  category: service_creation
  product: windows
detection:
  selection:
    EventID: 7045
  filter_path:
    ImagePath|contains: 'cloudflared'
  filter_masquerade:
    ImagePath|contains:
      - 'MicrosoftEdgeUpdate64.exe'
      - 'msmp.exe'
  filter_legit:
    ImagePath|contains: '\Program Files (x86)\Microsoft\Edge'
  condition: selection and (filter_path or filter_masquerade) and not filter_legit
falsepositives:
  - Legitimate enterprise use of Cloudflare Tunnel for approved remote-access/zero-trust deployments (allow-list known-good service names/paths)
level: critical
```

**Known false positives:**

- Legitimate, sanctioned Cloudflare Tunnel deployments for zero-trust remote access — allow-list known-good service names and binary paths/hashes

**Tuning notes:** Allow-list any organizationally-approved cloudflared service by binary hash/path; treat any hit on the MicrosoftEdgeUpdate64.exe/msmp.exe masquerade filter outside the real Edge directory as high-confidence regardless of the cloudflared string match.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- N-central Trusted-Relationship Abuse — Single Partner Account Pivoting to Multiple Downstream Organizations (locked: unlock with TL Creds)
- Domain Reconnaissance Command Sequence Following N-central Compromise (net user / net group / nltest) (locked: unlock with TL Creds)
- Redundant Remote-Access Tool Sprawl + Rogue TacticalRMM Callback to [indicator] (locked: unlock with TL Creds)
- N-central Alternate-Path Auth Bypass Request Pattern (CVE-2026-18577 Incomplete-Patch Exploitation) (locked: unlock with TL Creds)
- PhantomKiller BYOVD EDR-Evasion Tool — Kernel Driver Load and Security-Software Fingerprinting (locked: unlock with TL Creds)
- Network Connection to Disclosed C2 IP/Domain Watchlist (Cloudflare Tunnel / QuickConnect Infrastructure) (locked: unlock with TL Creds)
- N-central Auth Bypass Exploitation — Admin Access From Disclosed Attacker Infrastructure (CVE-2026-18556/CVE-2026-18577) (locked: unlock with TL Creds)
- Rogue Domain Account Creation ("veeam") and Administrator Password Reset via Compromised N-central Access (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 35)

Defanged, TLP:CLEAR.

- IP address: `173.249.252[.]176`
- Domain: `mousears[.]synology[.]me`
- IP address: `173.249.252[.]200`

Full set of 35 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist](https://thehackernews.com/2026/08/n-central-attackers-reach-managed.html)
- [N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete](https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html)
- [CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises](https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html)
- [N-able warns of N-central auth bypass flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/n-able-warns-of-n-central-auth-bypass-flaw-exploited-in-attacks/)
- [Critical N-able N-central Vulnerability and Active Exploitation](https://www.huntress.com/blog/n-able-vulnerability-exploitation)
- [N-able N-central exploitation results in RMM tool deployment](https://www.sophos.com/en-us/blog/nable-ncentral-exploitation-results-in-rmm-tool-deployment)
- [N-central 2026.3 Hotfix 2 -- Additional Mitigation for CVE-2026-18577](https://status.n-able.com/2026/08/06/n-central-2026-3-hotfix-2-additional-mitigation-for-cve-2026-18577/)
- [N-central 2026.3 Hotfix 1 -- Mitigation for CVE-2026-18577](https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/)
- [N-central Security Update -- August 6, 2026](https://www.n-able.com/blog/n-central-security-update-august-6-2026)
- [N-central Security Update -- August 2, 2026](https://www.n-able.com/blog/n-central-security-update-august-2-2026)
- [CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild](https://www.rapid7.com/blog/post/etr-cve-2026-18577-n-able-n-central-authentication-bypass-exploited-in-the-wild/)
- [Rapid7 Vulnerability Database: CVE-2026-18556](https://www.rapid7.com/db/vulnerabilities/cve-2026-18556/)
- [N-able N-central Auth Bypass -- CVE-2026-18556 & CVE-2026-18577](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-18556-cve-2026-18577/)
- [Attackers exploit N-able N-central flaw to reach managed endpoints (CVE-2026-18577)](https://www.helpnetsecurity.com/2026/08/03/cve-2026-18577-n-able-n-central-vulnerability/)
- [CVE-2026-18556 / CVE-2026-18577](https://arcticwolf.com/resources/blog/cve-2026-18556-cve-2026-18577/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1941