There's an irony so thick you could spread it on toast: a piece of software whose entire job is letting IT teams remotely manage and secure other people's computers just handed strangers the keys to do exactly that, without so much as a password.

From Zero-Day to "God Mode" in One Bug

N-able disclosed CVE-2026-18577 in its N-central remote monitoring and management (RMM) platform, a vulnerability that lets an unauthenticated attacker gain full administrative access to the console — CVSS score 8.2, both on-prem and cloud installs affected. N-able first spotted the attacks on July 31 after its own detection service flagged suspicious activity at a customer site, and traced it back to a zero-day already being actively exploited in the wild.

CISA added it to the Known Exploited Vulnerabilities catalog and gave federal agencies just three days to patch — a deadline the agency reserves for the "this is actively being used against real networks right now" tier of bug. N-able shipped hotfix 2026.3.1.7 on August 2, and a second one followed days later after the vendor confirmed attackers had reached customer networks.

The MSP Blast Radius Problem

N-central isn't a random app — it's the control panel managed service providers use to run remote sessions, push scripts, and automate jobs across every client device they oversee. "God-mode" access to that console doesn't compromise one company. It potentially hands an attacker a master key to every business that MSP touches, which is exactly the kind of one-to-many blast radius that turns a single bug into a headline about hundreds of victims.

This is the same pattern the industry keeps relearning the hard way: the tools built to protect infrastructure are themselves high-value targets, precisely because they're trusted with more access than almost anything else in the stack.

If your RMM tool is the thing keeping the lights on for your whole client roster, patch day isn't optional — it's the whole job.

This is the exact supply-chain-adjacent risk our free guide walks through — grab it at WTK's developer security checklist before your vendor tools become someone else's attack surface.

Source: The Hacker News