Breaking: N-able N-central Emergency Directive + TeamCity RCE Exploited — 7 August 2026
N-able N-central Under Active Attack — CISA Issues Emergency Directive
CISA has issued an Emergency Directive under Binding Operational Directive 26-04, requiring federal agencies to patch CVE-2026-18577 in N-able N-central within 72 hours — a timeline usually reserved for the most urgent vulnerabilities. The reason: attackers are already inside.
N-able disclosed on August 3 that threat actors exploited an authentication bypass in its N-central remote monitoring and management platform, gaining full administrative control of MSP consoles. The initial fix for CVE-2026-18556 (released in version 2026.2) was incomplete. Attackers found an alternative path, now tracked as CVE-2026-18577, which affects all builds prior to 2026.3.1.7.
Once inside, the attackers used N-central's built-in Take Control feature to pivot into managed endpoints, then deployed Cloudflare tunnels (registered as persistent services) to maintain access even after the original route was revoked. Huntress observed post-exploitation activity including domain controller reconnaissance and process enumeration across at least nine organisations under one compromised partner account. The attackers routed traffic through Mullvad and NordVPN exit nodes.
N-able has published six attacker IP addresses and IOCs including svchost.exe in user Documents folders and a registered service named Cloudflared. As of August 3, nearly 28% of self-hosted N-central servers remained unpatched and internet-exposed.
So what: If you run or rely on N-central, patch to 2026.3.1.7 immediately. Patching alone is not sufficient — you must also hunt for Cloudflare tunnel persistence on managed endpoints and review Take Control session logs for unauthorised access. The MSP attack vector makes this a supply chain concern: verify your providers have patched, not just your own infrastructure.
JetBrains TeamCity RCE Actively Exploited — CVSS 9.8
CISA added CVE-2026-63077 to the Known Exploited Vulnerabilities catalog on August 5, confirming active exploitation in the wild. The flaw is a deserialization vulnerability in JetBrains TeamCity On-Premises that allows unauthenticated remote code execution via the agent polling protocol. CVSS 9.8 (3.1) and 10.0 (2.0). It affects every TeamCity On-Premises version ever shipped.
The federal patching deadline is August 8. JetBrains has not yet confirmed the exploitation details, and the threat actors involved are unidentified. Successful exploitation exposes CI/CD pipeline credentials, build artifacts, and potentially downstream development infrastructure.
So what: If you run TeamCity On-Premises, patch now. This is a textbook CI/CD compromise vector — the kind that hands an attacker your source code, signing keys, and deployment pipelines on a plate. Cloud (SaaS) instances are not affected.