News AnalysisStanding

N-able Patch Gap Matches KEV and Campaign Data

Updated 04 August 2026 · Timeframe: Current snapshot

N-able reported that attackers took over N-central servers after the first patch for CVE-2026-18577 proved incomplete. The CVE carries an 83rd-percentile EPSS, entered KEV the day after publication, and maps to CWE-288. Twelve of sixteen exploit-campaign reports are confirmed. Five of six supply-chain-compromise reports are also confirmed.

Why it matters

Confirmed campaigns against an authentication bypass show how an incomplete fix turns a server issue into customer reach.

What to do

• Security leaders. Verify every N-central instance is now at 2026.3.1.7 or later; treat any older build as actively targeted.
• Lean IT orgs. Run the version check across the fleet today and stage the update outside normal windows.
• MSPs. Push the 2026.3.1.7 build to all managed N-central servers and confirm customer tenants are isolated until done.

Our take

Our own data behind a live news story, generated on tap — the depth the headline skips.