Precursor Intelligence
Threat News
Latest cyber threat intelligence, breaches and exploitation
2 matching stories
N-Able N-CentralStormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577
A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.
CISA KEV adds N-Able N-Central RCE with 3-day federal deadline
CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.
