N-able N-central CVE-2026-18577: MSP servers hijacked via auth bypass, persisted with Cloudflare tunnels

> In short: CVE-2026-18577 is an authentication bypass in N-able's N-central remote monitoring and management (RMM) platform. Attackers exploited it to gain administrative access to N-central servers, then used the built-in Take Control feature to reach managed endpoints, and registered Cloudflare tunnels as Windows services for persistent, firewall-evading access. N-able's first fix was incomplete. Build 2026.3.1.7 (shipped August 2) is the first unaffected version.

Why this matters to you

N-central is an RMM platform used by managed service providers (MSPs) and internal IT teams to administer customer and employee endpoints at scale. If your SaaS product is sold to organizations that use an MSP for IT management, the MSP's RMM is a pivot point to your clients' infrastructure. A compromised N-central server is effectively a master key to every endpoint it manages.

This case is also a textbook example of modern persistence — and the persistence technique (Cloudflare tunnels as services) is directly portable to any SaaS or infrastructure context.

The attack chain

The Cloudflare tunnel technique is worth understanding because it applies far beyond MSPs. Any attacker who can run a process on your server can register a tunnel that gives them persistent, encrypted, outbound-only access — invisible to inbound firewall rules.

The incomplete-fix problem

N-able shipped a fix, but it was incomplete — the first patched version did not fully close the bypass. The complete fix arrived in build 2026.3.1.7. This is a pattern we see across vendor responses: the first patch addresses the primary attack vector but misses a variant, and the attacker returns through the gap. The operational lesson: after patching an auth bypass, verify the fix with an independent test, not just the vendor's changelog.

What to do

The broader lesson: outbound-only persistence

The Cloudflare tunnel technique represents a shift in attacker persistence that inbound-focused firewalls cannot detect. The tunnel connects outward to a legitimate service (Cloudflare), uses encrypted HTTPS, and requires no listening port. The defense is egress monitoring: track outbound connections from your servers and endpoints, alert on new destinations, and block tunnel relay services where they're not needed. For a SaaS vendor, the same applies to your own infrastructure — an attacker who deploys a tunnel on your application server has persistent access that your inbound WAF and firewall will never see.