N-able Confirms Attackers Reached Customer Networks Through N-central 'God Mode' Flaw
N-able has confirmed what the earlier 'God mode' warnings only implied: attackers used the N-central flaw (CVE-2026-18577) to reach downstream customer networks. A second hotfix has landed after the first fix was bypassed. Here is what MSPs should verify now.
N-able has confirmed that attackers used the N-central "God mode" flaw to reach customer networks, moving the incident from a theoretical worst case to a documented one. The company also shipped a second hotfix after its first fix was shown to be bypassable. Both developments, reported by The Register on August 7, turn the "God mode" framing that has trailed this bug for a week into a statement about actual downstream compromise.
The distinction matters for every managed service provider that runs N-central. N-central is the console an MSP uses to administer its clients, so a flaw that hands an unauthenticated attacker administrative control is not a single-tenant problem — it is a route into every environment that console touches. N-able's confirmation that attackers reached customer networks through CVE-2026-18577 means the platform's own trust relationships were turned against the customers it manages.
What N-able Confirmed
Earlier reporting described the flaw's potential: an authentication bypass in N-central that could grant an attacker administrative, or "God mode," control of the remote-monitoring console. What changed this week is the shift from potential to actual. N-able has acknowledged that a "limited number of customers" were compromised through the flaw, and that intrusions did not stop at the console — they extended outward to the customer networks that N-central manages.
The second hotfix is the other half of the story. The first fix, which shipped in early August, was found to be bypassable, meaning an attacker could route around it and reach a still-vulnerable code path. N-able's follow-up build is meant to close that gap. This is the same patch-bypass dynamic we covered when the flaw first surfaced in our report on the initial N-central exploitation and bypassed patch; the vendor has now had to iterate on its own remediation a second time.
Which CVE the Confirmation Attaches To
Precision matters here, because two identifiers have circulated in the same news cycle. The confirmation that attackers reached customer networks attaches to CVE-2026-18577 — the N-central authentication-bypass flaw N-able has been racing to patch. A related identifier, CVE-2026-18556, described an earlier N-central advisory whose incomplete fix set up the account-takeover path that CVE-2026-18577 now covers. When you read "customer networks reached," read CVE-2026-18577.
That is also the CVE the U.S. Cybersecurity and Infrastructure Security Agency added to its catalog. We tracked that step in our coverage of the CVE-2026-18577 KEV listing, and the resulting 3-day federal patch deadline was an early signal that regulators viewed this as ongoing, not hypothetical. This week's confirmation is what that urgency was built around.
Why MSPs Are the Blast Radius
N-central's job is to reach into managed environments and run privileged actions: push scripts, deploy tools, change jobs and policies, open remote sessions. Those are the same capabilities an attacker inherits once they hold the console. The supply-chain shape of this incident is not incidental — it is the point. One compromised N-central instance is a foothold in every downstream customer that instance administers, which is why N-able's confirmation lands harder than a typical single-product bug.
Several details remain unconfirmed, and defenders should treat them as open questions rather than settled facts. N-able has not published which specific customer networks were reached, nor a count of downstream compromised endpoints. It is also not established whether the second hotfix has itself been tested against fresh bypass attempts, or whether CISA has updated its KEV entry to reflect the customer-network confirmation. Plan for the worst case while those gaps stay open.
What Defenders Should Verify Now
- Upgrade to the latest N-central build immediately. Confirm the second hotfix is installed, not just the first. Vendor-hosted instances receive the fix automatically; self-hosted deployments must apply it by hand, so verify the running version rather than assuming.
- Audit customer-endpoint access logs since late July. The confirmed activity reached downstream networks, so scope your review to managed endpoints and look for unexpected script execution, new tooling, altered jobs or policies, and remote-control sessions you cannot account for.
- Hunt for persistence. Reporting on this campaign has described attackers pivoting from the console into managed endpoints and standing up outbound tunnels for persistent access. Check for unexplained outbound tunnels and newly created administrative accounts.
- Monitor for further bypass advisories. The first fix was bypassed once. Until the second hotfix has a clean track record, keep watching N-able's advisories and CISA's KEV catalog for updates, and re-verify after any new build.
My read: The confirmation does not change what defenders should do — it removes the excuse for waiting. A bypassed first patch plus a documented reach into customer networks is the combination that separates "we scheduled the upgrade" from "we verified every managed environment." If you run N-central, the useful posture this week is to assume the console could have been touched during the exposure window and to prove otherwise from your own logs, not from the vendor's summary. The second hotfix closes the door that was open; it does not tell you whether someone already walked through it.
