N-able said attackers exploited an authentication bypass in N-central to gain remote administrative access and reach the customer systems managed through those servers. Its first fix was incomplete. CVE-2026-18577 affects N-central builds prior to 2026.3.1.7.
N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete
Summary + source link. No paywalls, no tracking.