#CyberWeekly

Every key in the building hangs on one board, behind one small lock nobody has looked at in years.

Your IT partner manages your machines from a single platform, and this week one of those platforms was taken over while people were using it. N-able published an advisory on 2 August for CVE-2026-18577 in N-central, an authentication bypass that lets a remote attacker skip the login entirely and take administrative control of the server. CISA added it to its Known Exploited Vulnerabilities catalogue on 3 August and told US federal agencies to fix it by 6 August.

• The attacker did not need to install anything. After taking the server, they used Take Control, the platform's own built-in remote-access feature, to reach the endpoints it manages. Nothing exotic ran. The tool that was supposed to be there did the work.
• It is a second attempt at the same door. CVE-2026-18577 exists because the fix for an earlier bypass, CVE-2026-18556, was incomplete. A patched system was not a fixed system, which is the uncomfortable part: "we applied the update" was true and still not enough.
• The fixed build is 2026.3.1.7 (N-central 2026.3.1 Hotfix 1). Every version up to and including 2026.3.1 before that hotfix is affected.

What this means if you are not an IT company: you almost certainly do not run N-central. Somebody manages your machines with something, though, and that something has the same shape. One question to your IT partner this week: which platform do you manage us from, is it on the current version, and can you tell whether it was used to reach our machines? A partner who can answer all three quickly is a good sign in itself.

The caretaker's keys open every door in the building. That is the point of them.

Taking over a management platform is the loud version. The ordinary version is that attackers use remote-access software you already trust. It has its own entry in the MITRE ATT&CK catalogue, T1219.002, Remote Desktop Software. Scattered Spider has deployed TeamViewer and AnyDesk. Storm-1811 has used ScreenConnect and NetSupport Manager.

• They pick these tools because they are legitimate. The installers are digitally signed, the vendors are known, and the software is very often already on an allow-list because your own IT people need it. A security product that blocked AnyDesk outright would break the helpdesk, so it does not.
• There is nothing to detect in the usual sense. No malware, no strange binary. A support tool starts a session, which is exactly what a support tool does all day.
• The old name for this was pcAnywhere, and Symantec buried that a decade ago. The current versions are TeamViewer, AnyDesk, ScreenConnect, Splashtop, and plain Remote Desktop. If your business is more than fifteen years old, the category is not new to you, only the names are.

The question that actually finds something: ask for a list of every remote-access program installed on your machines, and read it yourself. You are not looking for something suspicious. You are looking for a name you cannot account for. One tool that your partner uses is normal; three, from three different eras of IT supplier, is worth a conversation.

Before anything is taken, somebody quietly removes the copies from the drawer.

Access to the management platform is not the goal. The backup is. CISA's advisory on Medusa ransomware, AA25-071A, describes operators pushing obfuscated PowerShell through the management platform to harvest Veeam backup credentials and map the network, before any ransomware runs at all.

• The order matters more than the malware. Encrypting a company that can restore in an afternoon is a nuisance. Encrypting one whose backups were reached first is an emergency, and the attacker knows which of the two he has before he starts.
• Your management platform probably can reach your backups. That is not a flaw, it is how the thing works: the same tool patches the server and checks the backup job. It does mean one compromise reaches both.
• Offline or immutable copies are the whole defence here. A backup an administrator can delete is a backup an attacker with administrator rights can delete.

One test, not a policy: ask when a restore was last performed from a copy that the management platform cannot reach. Not whether backups run. Whether a restore was done, from something out of reach. If the answer is a date, you are in good shape. If the answer is a description of the backup schedule, you have your answer to a different question.

Once an issue, our in-house AI gets the floor. This week it would rather not have the floor.

If you want to know which of your own systems answer the internet before someone else checks for you, that is what our NIS2 and CyFun starting points are for.