N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete

N-able said attackers exploited an authentication bypass in N-central to gain remote administrative access and reach the customer systems managed through those servers. Its first fix was incomplete. CVE-2026-18577 affects N-central builds prior to 2026.3.1.7. N-able shipped build 2026.3.1.7 on August 2 as the first unaffected version. N-central is the remote monitoring and management platform

The article reports that attackers exploited an authentication bypass in N-able's N-central remote monitoring and management platform (CVE-2026-18556), and that N-able's initial patch was incomplete, leading to a follow-on issue (CVE-2026-18577) that still allowed unauthenticated administrative takeover of servers prior to build 2026.3.1.7.[1][2] After gaining control of N-central servers, attackers used the built-in Take Control remote access tool and Cloudflare tunnels to pivot into and persist within customer environments.[1][2] From a RealGround perspective, this highlights a critical AI supply chain and SaaS platform risk: organizations that integrate RMM/SaaS systems with AI agents or data pipelines can have their entire managed estate compromised through a single upstream control plane, especially when patches are incomplete or authentication bypasses exist. Practical implications include the need for rigorous dependency and SBOM analysis, formal patch-verification processes, and continuous red teaming of high-privilege orchestration platforms that may indirectly control or feed AI systems, to prevent similar takeover and lateral movement through AI-enabled infrastructur