The Australian Cyber Security Centre has issued a high alert after a critical flaw in the N-able N-central remote monitoring platform was found being actively exploited, including against Australian organisations.

• What it is: Two vulnerabilities (CVE-2026-18556 and CVE-2026-18577) let an attacker bypass authentication on N-central, a remote monitoring and management tool many IT providers use to manage client systems.
• Who is affected: Organisations, including managed service providers, running any current version of N-central, both cloud-hosted and on-premises.
• What the risk is: A successful attack can hand an unauthenticated intruder full administrative control of the console, and by extension the systems it manages.
• What to do: N-able released patches on 1 August and a further hotfix on 6 August. Any organisation running N-central should confirm the latest patches are applied without delay.

OzComm does not use N-central in our own environment, but if you rely on an IT provider or internal team using this platform, we recommend confirming with them directly that patching is up to date.