N-able N-central flaw exploited to take control of an entire network

Sophos described an attack on 4 August 2026 in which a vulnerability in N-able N-central was exploited to take privileged control of the server. The vulnerability is tracked as CVE-2026-18577 and is an authentication bypass. The attackers then used the remote control features in N-central to reach domain controllers, backup servers and application servers. They created a domain account named veeam, reset administrator passwords, performed network reconnaissance and installed the tools AnyDesk, TeamViewer, RustDesk, TacticalRMM and HopToDesk. They also gave Cloudflare Tunnel binaries names resembling legitimate Microsoft files in order to keep access, and used PhantomKiller to disable endpoint security processes.

What happens technically

N-central is a platform for remote monitoring and management, often referred to as RMM. It is built to reach every machine in an environment, run commands on them and install software without anyone sitting at the screen. The agent on each machine trusts the server, and that is the entire point of the product.

That is why the consequence of an authentication bypass is so large. The attacker does not need to break into each individual machine, but inherits a tool that is already permitted to do exactly that. The actions Sophos describes follow a recognisable pattern. New accounts and reset passwords provide a route in that no longer depends on the original flaw. Several different remote control tools provide several ways back if one of them is discovered. File names resembling Microsoft files are meant to let the tunnel blend into what looks normal, and a tool that disables endpoint security removes whatever would otherwise raise the alarm. The account name veeam is worth noting, because an account that appears to belong to the backup solution rarely attracts attention in a busy operations day.

What this means for you if you have outsourced IT operations

If you have outsourced your IT operations, the odds are you have never heard of N-central. The platform is used by managed service providers, and it usually sits with the provider rather than with you. The first sign you see yourself is unfamiliar remote control tools appearing on your own machines. In our view this is supplier risk in its purest form, where a vulnerability at someone else grants full access at your place.

The questions for your provider are therefore concrete. Which version of the remote management platform do they run, when was it last updated, and how is access to it protected. Then comes the question you have to answer yourself. Which remote control tools are approved in your environment, and would you notice if a new one appeared. Sophos describes five different tools in this case. If you hold no list of the approved ones, you hold no list of the unexpected ones either. If your organisation is covered by NIS2, this is supplier management under Article 21, and in our assessment the control that returns the most.

Berigo recommends

• Ask the operations supplier to confirm in writing which version of N-central is running, and when it was updated.
• Build a list of approved remote control tools, and alert when anything else is installed.
• Look for newly created accounts and reset administrator passwords over the recent period, especially accounts resembling service accounts.
• Monitor whether endpoint security processes are stopped, and let that raise an alert immediately.
• Settle in the contract how the supplier notifies you about an incident in their own platform, and how quickly.