Quick answer
In September 2026, attackers used N-able’s N-central deployment platform — the exact channel IT teams use to push software and patches — to reach every endpoint it managed, including on a server that was already fully patched. The console built to deploy at scale turned out to deploy the breach at the same scale.
- N-able shipped five emergency zero-day fixes for N-central in six weeks
- The last one, CVE-2026-86218, scored a maximum 10.0 CVSS and needed no login at all
- Huntress found attackers inside a server that was already running the latest hotfix
- The turn: patching the deployment tool is not the same as watching what it does
Every IT team runs at least one console that can touch every machine it manages. That is the entire point of it. One login, one click, and a patch, an app, or a script lands on a thousand endpoints at once.
Nobody questions why that console has so much reach. It needs it to do its job.
Attackers have noticed the same thing IT teams rely on: reach. A console built to push software to everyone is also a console built to push ransomware to everyone, the moment someone else holds the keys.
In September 2026, that stopped being a hypothetical. It happened to N-able’s N-central, one of the more widely used remote monitoring and deployment platforms among managed service providers and internal IT teams.
And it happened to a customer who had already applied the latest patch.
A Platform Built to Reach Everything, Now Reaching Attackers Too
N-central exists to give IT one place to deploy, monitor, and remotely control every endpoint under its management. That is standard for the category — the same design behind most RMM and mass-deployment platforms on the market.
Between August and September 2026, that design turned into a six-week run of emergency patches.
The pattern was not limited to one vendor. Weeks earlier, a separate authentication bypass in SimpleHelp — a different deployment and remote-support platform — let attackers self-register as a technician account and reach every endpoint it managed too.
Why a Patched Console Still Got Owned
On September 4, 2026, Huntress opened an investigation after a customer’s N-central production server was compromised. The server was running 2026.3.1.10 — the latest hotfix available at the time.
The attackers did not need a fresh exploit to do damage. Once inside, they used N-central’s own “Take Control” feature — a legitimate deployment and remote-access function — to pivot into every endpoint the console managed, then planted Cloudflare-based tunnels for persistence.
| Flaw | Type | Fixed | Notable detail |
|---|---|---|---|
| CVE-2026-18577 | Authentication bypass | Hotfix, Aug 2, 2026 | Exploited as a zero-day starting July 31 |
| CVE-2026-86206 / 86207 | Exploit chain | Hotfix, Sept 5, 2026 | Reported by Huntress days earlier |
| CVE-2026-86218 | Static code injection, pre-auth RCE | Hotfix 4, Sept 5, 2026 | CVSS 10.0, added to CISA’s KEV catalog |
Patching each flaw as it surfaced was necessary. It was not sufficient — the compromise on September 4 hit a server that had already done exactly that.
What Stays Invisible
Which deployment tools are actually running
Most companies can name their primary RMM or deployment platform. Fewer can say whether a second one, installed by a vendor or a former contractor, is still running somewhere in the fleet.
Whether the console gets patched as fast as the endpoints it manages
Deployment platforms exist to keep everything else current. The one thing that rarely gets the same urgency is the platform itself.
What the console did after it was compromised
A “Take Control” session or a mass software push looks identical whether an administrator or an attacker triggered it. Huntress noted that log rotation limited how far back the investigation could see.
An auditor will ask who can push software to every endpoint at once, and how that activity is logged. “Our RMM vendor handles that” is not an answer an auditor accepts — the log, the retention period, and the access list have to exist on your side, independent of the vendor.
The tool built to reach every endpoint at once is exactly what an attacker wants control of first.
It Is Not a Staffing Problem, It Is a Visibility Problem
None of the IT teams affected in September were careless. They patched. Some patched within days of each advisory.
What none of them had was a clear, independent record of what their deployment console actually did — separate from the console’s own logs, which is exactly what an attacker who owns the console can also erase.
How to Reduce the Blast Radius
- Inventory every deployment and RMM agenton every endpoint, not just the one IT installed on purpose.
- Treat the console as a top-tier assetand patch it the same day, not on the endpoint patch cycle.
- Limit who holds console-wide control rightsto the smallest group that can still do the job.
- Log console activity outside the console itselfso an attacker who owns the platform cannot also erase the evidence.
- Keep one access path that does not depend on the same platformfor the day the primary one is the thing that is compromised.
“Take Control” and mass-deployment actions in most RMM platforms are logged inside the platform’s own database by default. If that database is what the attacker controls, the log is not independent evidence — it is a second thing they can edit. Independent logging means the record lives somewhere the console cannot reach, even from an administrator session.
How INGITE helps
Cloud Software Deployment
Push software, patches, and updates from a channel with its own independent activity log — visible to your team, not only to the console doing the pushing.
Cloud EndPoint Security
See every agent and remote-access tool actually running across the fleet, including the ones a vendor or a former contractor left behind.
If Your Deployment Console Were Compromised Tonight, Would You Know Before the Ransomware Note Did?
Answer these with evidence you can pull right now, not with what you assume is true.
- Can you list every RMM or deployment agent installed across your fleet, today, without asking each vendor?
- Is your deployment console on the same patch-same-day priority as a production server, or does it wait for its turn?
- If the console’s own logs were wiped, would you have any other record of what it pushed and to whom?
- Who currently holds console-wide control rights, and when was that list last reviewed?
If the honest answer to any of these is “we would have to ask the vendor,” the console is not covered — it is trusted on faith.
What happened with N-able N-central in September 2026?
Why are RMM and deployment tools attractive targets for ransomware groups?
Can a fully patched system still get compromised?
How can a company reduce the risk from its deployment or RMM platform?
Know what your deployment channel does, not just what it patched
Cloud Software Deployment gives IT a mass-deployment channel with its own independent log — so the console that reaches every endpoint is never the only witness to what it did.