On August 6, 2026, N-able had to release a second hotfix for N-central because the first patch had not fully remediated the actively exploited vulnerability CVE-2026-18576. For CISOs using N-central, there is immediate need for action, as the RMM solution is already being attacked.
N-able has released a second hotfix for its endpoint management and RMM solution N-central within just a few days. The reason is that the first hotfix, delivered in early August 2026, did not sufficiently address the vulnerability CVE-2026-18576. According to the source, the second hotfix was made available on August 6, 2026, just hours after it became known that the first fix was insufficient.
Particularly critical is the fact that the vulnerability is already being actively exploited in attacks. N-central is typically operated by managed service providers and internal IT departments with extensive administrative rights over managed endpoints. A successful compromise of the platform could therefore potentially give attackers access to a large number of downstream systems, making RMM solutions a preferred target for supply-chain-style attacks.
CISOs who use N-central, or whose service providers operate the platform, should check whether the first hotfix from early August 2026 has already been applied and whether it has been replaced or supplemented by the second hotfix from August 6, 2026. Since the vulnerability is already being exploited in the wild, deploying the current hotfix should be prioritized and not left to the regular patch cycle. In addition, it is advisable to review existing logs for signs of a compromise that may have already occurred in the period between the disclosure of the vulnerability and the deployment of the effective fix.
The first patch against the actively exploited vulnerability CVE-2026-18576 in N-able N-central was insufficient, which is why a second hotfix was released on August 6, 2026.
Source: borncity.com · Published August 7, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.