MSPs urged to patch immediately after N-able issues hotfix for N-central ‘god mode’ flaw

Security experts have issued a warning over a critical vulnerability in a popular tool used by managed service providers (MSPs).

N-able disclosed a critical vulnerability in its N-central platform, a remote IT management service, which currently affects all versions spanning both on-prem and hosted deployments.

The flaw grants hackers unauthenticated ‘god mode’ access to the remote management software, according to researchers at Huntress.

This means a compromised server could be used to “run scripts, push tools, and open remote sessions across every downstream endpoint it manages”.

Notably, Huntress warned its analysis shows the flaw is now being actively exploited in the wild.

“We are now seeing threat actors targeting the flaw across multiple organizations, though we are not yet seeing evidence that this has become a broad, indiscriminate campaign across our partner base,” the company noted in a blog post.

Researchers noted that attacks involving the flaw typically include the “same partner of behavior”, with threat actors carrying out “high-level reconnaissance to target key servers” such as Domain Controllers.

Upon compromise, threat actors were found to have rapidly moved across hosts in impacted IT environments. As such, Huntress urged affected organizations to consider temporarily disabling the tool.

“Because this vulnerability bypasses normal authentication, if your N-central server is still broadly reachable from the internet or other untrusted networks, you should consider disabling N-central—up to and including taking the server offline.”

N-central hotfix is available

The vulnerability in question, tracked as CVE-2026-18577, was initially discovered after an incomplete fix for an earlier authentication bypass flaw (CVE-2026-18556).

N-able confirmed a hotfix is available for CVE-2026-18577. For hosted customers, mitigations were applied to all instances, according to the firm.

On-prem customers, meanwhile, are urged to download the hotfix and update immediately.

N-able also detailed a series of checks and actions customers can carry out upon updating, including:

• Upgrading N-central agents
• Reviewing systems for indicators of compromise (IOCs)
• Contacting the firm if evidence of compromise is discovered

“We strongly recommend staying vigilant and monitoring your environments closely in the meantime. Further updates will be shared as quickly as possible,” the company said in an advisory.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.