N‑able Confirms Hackers Hijacked Customer Networks Using 'God Mode'

N-able confirmed this week that attackers who found a key under the mat to its N-central platform have already walked through the front doors of its customers' houses according to The Register Security. The confirmation came alongside a second mandatory hotfix, released just days after the first, revealing a containment and remediation effort moving at emergency speed.

From Admitting the Flaw to Confirming the Breach in 96 Hours

The sequence of events reads like a textbook crisis escalation. On July 31, N-able's own Adlumin MDR service spotted suspicious activity at a customer. By August 2, the company disclosed CVE-2026-18577, a critical flaw allowing unauthenticated attackers to gain full administrative "God mode" access to N-central servers, and released its first emergency patch, version 2026.3.1.7.

The U.S. Cybersecurity and Infrastructure Security Agency deemed the threat so urgent it gave federal agencies a brutal three-day deadline to patch, adding the bug to its Known Exploited Vulnerabilities catalog on August 3. Yet by Thursday, August 6, N-able was pushing out Hotfix 2, version 2026.3.1.10, with a stark warning: "This is not a duplicate of our previous communication. Hotfix 2 is required, even if you already applied the earlier hotfix."

The rapid-fire second patch signals two things. First, the initial fix may have been incomplete or attackers quickly found a way around it, though N-able has not specified what "further hardening measures" Hotfix 2 adds. Second, and more critically, the vendor's investigation had by then confirmed attackers didn't just stop at the N-central server. They used that all-powerful access to launch the platform's Take Control feature, connecting directly to managed endpoints inside customer networks. Once on those systems, they registered Cloudflare Tunnel services to maintain access even if kicked off the main server.

N-able says a "limited number" of customers were affected, but has not said how many that means, how many downstream systems attackers reached, or what they did once they had established persistent access.

The God Mode Leverage: One Compromise, Endless Downstream Access

The technical vulnerability, with an estimated CVSS score of 9.8, is severe on its own. But its true danger lies in the architecture it exploits. N-central is a Remote Monitoring and Management (RMM) platform used predominantly by Managed Service Providers. An MSP uses one N-central server to administer thousands of endpoints across dozens of client companies.

XOOMAR Interpretation: This creates a catastrophic force multiplier. As Huntress researchers noted, a compromised RMM gives attackers "the same level of control normally reserved for trusted network operation and engineering staff." They can push scripts, deploy tools, and initiate remote-control sessions into any connected system, from workstations to domain controllers.

In this campaign, that's exactly what happened. Sophos threat researchers, who also observed the attacks, reported one victim where the threat actor used the compromised N-central server to access "high-value endpoints such as a backup server, domain controllers, and application servers." They then created new admin accounts, mapped the network, and installed a suite of remote-access tools like AnyDesk and TeamViewer alongside the Cloudflare Tunnel.

The attack chain transforms a single software vulnerability into a proven software supply chain attack, where the trusted management tool becomes the perfect Trojan horse.

Detecting the N-central Compromise: Key IoCs

Organizations running N-central on-premises should hunt for these specific indicators, as provided by N-able and researchers:

• On Managed Endpoints: Check for a file named svchost.exe in the Documents folder, and for a registered service named Cloudflared.
• In N-central Logs: Look for unusual administrative logins, unexpected Take Control sessions, or new jobs/automation pushed from unfamiliar IP addresses.
• Attacker Infrastructure: N-able has published a list of 10 IP addresses used in the attacks, available in its security advisory.

The Patching Paradox and a Fragile Ecosystem

The urgent call for Hotfix 2 exposes a painful reality for the MSP industry: securing these critical control points is not just about speed, but about completeness. Huntress reported that as of early August, more than half (55.6%) of the N-central servers in its partners' and customers' environments remained unpatched against the first hotfix. They noted these servers often lack endpoint detection and response software, running as hardened appliances.

This creates a dangerous lag where a known, actively exploited "God mode" flaw remains wide open in a significant portion of the attack surface for weeks. The consequences cascade from the MSP to every one of its clients.

XOOMAR Analysis: N-able’s confirmation of network breaches, paired with its vague "limited number" description and refusal to answer basic questions about scope, places MSPs in an impossible position. They must urgently patch, investigate their own environments for compromise, and potentially notify their own clients, all while operating with incomplete information from the vendor. This incident echoes past failures in securing critical software infrastructure, as seen when a Routine Chrome 151 Patch Masks Software's Skeletal Truth, highlighting the industry's struggle with transparent and effective vulnerability management.

The New MSP Mandate: Assume Your RMM Is a Target

The N-central breach is not an anomaly; it's a clarion call. RMM and PSA platforms are now prime targets because they offer the highest possible return on a hacker's investment. One exploit can yield access to hundreds of distinct networks.

The forward-looking implications are stark:

1. Intensified Offensive Scans: Threat actors will aggressively scan for and stockpile exploits against every major RMM platform, knowing the payoff is immense.
2. Architectural Reckoning: The current model of all-powerful, centralized management consoles is inherently risky. The industry will face pressure to develop architectures with stricter privilege separation and zero-trust principles baked in, moving beyond reactive patching.
3. Client-Driven Scrutiny: End-client companies, now aware their security can be bypassed via their MSP's tools, will demand more visibility, control, and auditing rights over the management software used on their networks. This will fundamentally alter MSP-client contracts and service level agreements.

For any MSP using N-central, the immediate path is clear: install Hotfix 2 immediately, even if Hotfix 1 is applied. Then, assume a breach has occurred and hunt for the documented indicators of compromise across every managed endpoint. As Huntress pragmatically advised, for higher-risk environments where exposure can't be reduced, "temporarily disabling N-central until you are able to apply N-able’s hotfix may be the safer choice."

The days of treating RMM security as a backend IT concern are over. It is now the frontline of defense for countless organizations, and this breach proves that frontline has been decisively crossed.

Impact Analysis

• This critical vulnerability allowed attackers to bypass all security controls and directly access customer networks.
• The rapid release of a second hotfix indicates the initial fix was insufficient, leaving organizations exposed to ongoing attacks.
• CISA's three-day patching deadline underscores the immediate, systemic risk to critical infrastructure and federal agencies.