Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-18556 | — | 40.2% | ✅ listed | — | 72.91 (High) |
| CVE-2026-18577 | — | 54.1% | ✅ listed | — | 73.08 (High) |
| CVE-2026-86206 | — | 0.7% | — | — | 1.27 (Info) |
| CVE-2026-86207 | — | 0.7% | — | — | 4.4 (Info) |
StormEncryptor ransomware via N-central auth-bypass
A former Medusa affiliate identified as Storm-1175 is deploying a new ransomware variant, StormEncryptor, through an authentication bypass in N-able’s N-central remote monitoring and management platform. The flaw, tracked as CVE-2026-18577, is an incomplete patch for CVE-2026-18556 and affects N-central versions through 2026.3.1.
Successful exploitation grants a remote, unauthenticated attacker administrative access to the N-central RMM server. From there, the actor can pivot to managed downstream endpoints using the platform’s native Take Control feature, which is how StormEncryptor reaches the victim’s file systems.
How the auth-bypass works
CVE-2026-18577 is an authentication bypass via an alternate path or channel, rated CVSS 8.2 (High). It is an incomplete patch for CVE-2026-18556, which fixed the initial bypass in 2026.2. The new vector bypasses the original correction and remains effective against the base 2026.3 release.
Exploitation requires no valid credentials. A remote, unauthenticated attacker sends a crafted request sequence to the N-central server, bypassing authentication and obtaining administrative account access. From there, the attacker has full control over the RMM platform and can pivot to managed downstream endpoints using the native Take Control feature.
The flaw affects all N-central versions prior to 2026.3.1.7 (Hotfix 1). It is fixed in 2026.3.1.10 (Hotfix 2), which adds expanded protections after continued monitoring revealed the related attack path and evolving attacker techniques.
Post-exploitation: Cloudflare tunnel and EDR evasion
Once the attacker holds the N-central server, they pivot to managed endpoints using the platform’s native Take Control feature. This is a legitimate RMM capability, not a backdoor — the attacker initiates a remote session to each target device through the standard N-central interface.
For outbound persistence, the actor registers a Windows service named Cloudflared on the endpoint. The service runs a Cloudflare tunnel binary that gives the attacker a direct outbound path to the compromised machine without opening inbound firewall ports. The tunnel binary is dropped as svchost.exe in the user’s Documents folder, a name chosen to blend in with the system process.
To keep the endpoint’s EDR from flagging the session, the attacker deploys a tool called PhantomKiller. It disables Microsoft Defender and Sophos on the target before the tunnel is established, so the Cloudflared service and the subsequent file operations run with the endpoint’s primary EDRs out of the way.
IOCs and detection
Sophos published six IP addresses associated with the attack activity. The addresses are 173.249.252.200, 87.249.138.34, 37.19.210.32, 37.153.90.88, 92.118.112.181, and 68.235.46.214. They should be correlated against N-central interface logs, firewall and proxy telemetry, and endpoint events on the managed devices.
On the endpoint side, the attacker drops the Cloudflare tunnel binary as svchost.exe in the user’s Documents folder. The file is registered as a Windows service named Cloudflared, which gives the attacker a direct outbound path to the compromised machine without opening inbound firewall ports. The name is chosen to blend in with the system process.
CISA KEV and hotfix chain
CISA added both CVE-2026-18556 and CVE-2026-18577 to its Known Exploited Vulnerabilities catalog on August 3, 2026, and ordered US civilian federal agencies to remediate within three days. The KEV listing confirms the weakness is being actively exploited in the wild rather than sitting as a theoretical exposure.
The fix chain runs through four hotfixes. HF1 (2026.3.1.7) addresses the initial authentication-bypass path for both CVEs. HF2 (2026.3.1.10) adds expanded protections after continued monitoring revealed a related attack path and evolving attacker techniques. HF3 (2026.3.1.14) fixes two separately disclosed access-control flaws, CVE-2026-86206 and CVE-2026-86207. HF4 (also 2026.3.1.14) completes the chain. Operators should upgrade to 2026.3.1.14 or later to cover the full set.
Key points
- CVE-2026-18577 is an incomplete patch for CVE-2026-18556, allowing authentication bypass and account takeover in N-central versions through 2026.3.1
- Storm-1175, a former Medusa affiliate, is deploying StormEncryptor ransomware via the vulnerability
- Exploitation was first detected on August 1, 2026, and CISA added both CVEs to KEV on August 3, 2026
- Attackers use the Take Control feature to connect to managed endpoints, register a Cloudflared service, and drop svchost.exe in the user's Documents folder
- N-able shipped a second hotfix (2026.3.1.10) on August 10 as attackers kept exploiting the first one
Further reading & sources
- N-able N-central vulnerabilities: How to find impacted assets
- Attackers exploit N-able N-central flaw to reach managed endpoints (CVE-2026-18577) - Help Net Security
- CVE-2026-18577: N-able N-central Auth Bypass
- N-able N-central HF4 Patches Critical Pre-Auth RCE
- N-able warns of N-central auth bypass flaw exploited in attacks
- N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577 - Help Net Security