N-able warns of N-central auth bypass flaw exploited in attacks

N-able released hotfix 2026.3.1.7 for CVE-2026-18577, an authentication bypass affecting all N-central versions before 2026.3. The flaw, an incomplete patch for CVE-2026-18576, enables administrative account takeover. Hosted deployments received the update; on-premises customers must install it manually. Indicators of compromise include four IP addresses and a service named 'Cloudflared.