N-able’s August 1 security update is the kind of incident that should get attention well beyond the MSP community. The company says attackers exploited vulnerable on-premises N-central servers running version 2026.1 and earlier, obtained remote administrative access, used the platform’s Take Control feature to reach managed systems, and then registered Cloudflare Tunnel services for persistence after the original N-central access was revoked.

That is not just another product vulnerability. It is a reminder that remote monitoring and management platforms are control-plane infrastructure. If an attacker gets administrative access to the tool that administers endpoints across customer environments, the blast radius can cross organizational boundaries quickly.

What N-able reported

According to N-able’s security update, the company began investigating an unusual increase in licensing issues affecting on-premises N-central customers on July 31, 2026. During that investigation, N-able determined that attackers had found a vulnerability affecting N-central servers running version 2026.1 and below.

The public CVE record, CVE-2026-18556, describes the issue as an authentication bypass using an alternate path or channel. N-able recommends customers upgrade to N-central 2026.3 as an immediate protective measure.

The most important operational detail is what happened after exploitation: the attacker reportedly used Take Control to connect into systems managed by the N-central environment, then created Cloudflare Tunnel persistence on affected devices. That means defenders should not stop at patching the N-central server. They need to assume downstream endpoint access may have occurred and hunt accordingly.

Why this matters for SMBs and government contractors

Many small businesses and government contractors depend on MSPs, RMM platforms, and remote support tools because they do not have large internal IT teams. That is practical and often necessary. But it also means those tools become high-value infrastructure from an attacker’s perspective.

For defense contractors, healthcare suppliers, municipal vendors, and professional services firms handling sensitive customer data, an RMM compromise can look like legitimate administration. Remote sessions may originate from trusted tooling. Service creation may be performed by accounts that normally have broad rights. Standard endpoint alerts may be dismissed as IT activity unless the organization has strong logging, segmentation, and change review.

Defensive takeaways

  • Upgrade N-central immediately. N-able is directing customers on older versions to move to 2026.3. Treat exposed or internet-accessible N-central systems as emergency patch candidates.
  • Review administrative activity, not just vulnerability status. Pull logs for unexpected admin creation, unusual Take Control sessions, licensing anomalies, configuration changes, and access from unfamiliar IP addresses.
  • Hunt for Cloudflare Tunnel persistence. Look for new services, scheduled tasks, startup entries, or binaries associated with cloudflared or other tunnel clients on managed endpoints.
  • Separate MSP tooling from flat internal networks. Remote management should not imply unrestricted lateral movement. Use segmentation, least privilege, and device groups that limit downstream reach.
  • Require MFA and conditional access for administrative consoles. MFA does not fix an auth bypass, but it reduces follow-on account abuse and raises the bar for normal administrative access.
  • Define an MSP incident-response playbook before you need it. Customers should know who can disable remote access, rotate credentials, export logs, and validate endpoint persistence if the management platform is suspected.

Bulwark Black assessment

The core lesson is simple: MSP and RMM tooling should be treated like domain controllers, identity providers, and VPN concentrators. They are not ordinary applications. They are privileged control planes.

For SMBs and gov contractors, the practical move is to ask two questions today: “What systems can our remote management platform touch?” and “How would we know if that platform was used against us?” If the answer depends entirely on the MSP telling you, there is a visibility gap worth closing.

Source: N-able — N-central Security Update, August 1, 2026. Additional reference: CVE-2026-18556.