Attackers Exploit N-able Patch Bypass Flaw on RMM Servers

N-able disclosed a patch bypass vulnerability (CVE-2026-18577) that allowed attackers to gain administrative access to N-central servers, its remote monitoring and management (RMM) platform. Threat actors exploited this flaw over the weekend, leveraging the ‘Take Control’ feature to gain persistence and pivot to high-value servers, including domain controllers. While initial exploitation was limited, N-able recommends immediate patching and hardening of N-central environments to mitigate the risk of broader attacks.