CISA's Deadline Is Today — and Your Board Has Never Heard of the Vendor

On July 31, a company called N-able noticed something odd: a spike in licensing errors coming from customers who run its software on their own servers instead of N-able's cloud. Nobody thought much of it at first — licensing hiccups happen. By August 1, N-able knew why. Attackers had found a way to log into those servers as an administrator, without a password, and they'd been doing it for days.

Today is the deadline. The Cybersecurity and Infrastructure Security Agency gave federal civilian agencies three days — not the usual three weeks — to patch it. I'd guess fewer than one executive in twenty reading this has ever heard of N-able. That's not an accident. It's the whole problem.

What N-central Actually Does

N-able N-central is a remote monitoring and management platform — RMM, in the trade. Managed service providers and internal IT departments use it to push patches and reach into every machine they oversee, all from one console. It's plumbing. Nobody outside IT is supposed to think about it, which is exactly why it makes such a good target.

N-able's own name for the underlying flaw is blunter than anything I'd write: "unauthenticated administrative account takeover." That's CVE-2026-18556, patched back in version 2026.2. On the morning of August 2, N-able's engineers found that their fix didn't actually close the door — it just moved it. The new path in got its own CVE number, 2026-18577, and N-able shipped an emergency hotfix, build 2026.3.1.7, that same day. Both flaws carry a CVSS severity score of 8.2 out of 10, assigned by N-able itself.

Hosted customers were supposed to get the fix automatically. Everyone running N-central on their own hardware had to install it by hand. Many still haven't. Huntress, a security firm that tracks N-central deployments across its own client base, reported on August 3 that more than half — 55.6 percent — of the reachable cloud servers it monitors were still unpatched, even though those are the instances N-able says update on their own. The N-central server itself typically runs without endpoint protection, because it's treated as an appliance, not a workstation. The tool built to manage everyone else's security often has none of its own.

Nine Companies From One Login

Here's what the attack looks like once someone's inside. N-able says intruders took over an administrator account, then used N-central's built-in "Take Control" feature — the same remote-access tool a technician would use to fix your laptop — to reach managed endpoints. On those endpoints, they registered a Cloudflare Tunnel as a running service. N-able's advisory tells customers to look for a service named "Cloudflared" and a rogue file called svchost.exe sitting in the Documents folder — a tunnel that phones home without needing an open inbound firewall port, and survives a reboot.

Huntress found a live example. One compromised, self-hosted N-central account — a single MSP's login — gave attackers a foothold in nine separate downstream companies, one machine in each. In that case, the intruders looked around and disconnected. No tunnels installed, no ransomware dropped. Just reconnaissance, for now.

Sophos found a worse one. A customer in its telemetry was compromised at roughly 8 a.m. UTC on August 3. The attackers rode the N-central foothold straight to a backup server, domain controllers, and application servers, then created a new administrator account named "veeam" — presumably to blend in with legitimate backup-software service accounts — and reset the passwords on the real admin accounts. They mapped every domain admin in the environment and installed a stack of legitimate remote-access tools: AnyDesk, TeamViewer, RustDesk. Then they set up their own Cloudflare Tunnel disguised under fake Windows filenames and ran a tool called PhantomKiller to shut off Microsoft Defender and Sophos's own protection before anyone could see them coming.

Two customers, two outcomes — one contained, one nearly total. Same vulnerability, same vendor, same week.

The Part Your Board Should Actually Worry About

N-central has been down this road before. Almost exactly a year ago, in mid-August 2025, two other N-central vulnerabilities were caught being exploited in the wild — same platform, a different pair of CVE numbers. MSPs keep running it anyway, because the alternative — managing thousands of endpoints by hand — isn't realistic either.

I've watched this exact pattern play out with other tools that sit in the same spot in the stack. Kaseya's VSA platform was compromised in 2021, and REvil ransomware rode it into roughly 1,500 downstream businesses that had never heard of Kaseya either. ConnectWise ScreenConnect, SimpleHelp, SolarWinds Orion — different vendors, same shape of failure. One login screen, deep inside a vendor's vendor, holds the keys to everyone downstream.

In my experience advising boards after incidents like this, the reaction is almost always the same: nobody on the leadership team knew this software existed until it showed up in a breach notification. That's the gap. Your company's risk isn't only what your CISO can name off the top of their head. It's every tool your vendors, and your vendors' vendors, run without telling you.

What to Ask Your CISO This Week

Start with the direct question: does your organization, or any MSP managing part of your environment, run N-able N-central — and has it been patched to build 2026.3.1.7? Find out how anyone would even know if it hadn't been. Then push further and ask for the full list of remote-management tools touching your network, including the ones your vendors installed on your behalf, not just what your internal team put there. If one of those tools were compromised tomorrow, how would you find out, and how long would it take?

If the answer to any of that is a shrug, you've found your next board agenda item. Not next quarter's. This week's.