N-able told on-premises N-central users to install Hotfix 2

On August 6, 2026, N-able told on-premises N-central operators to install Hotfix 2, build 2026.3.1.10, even if Hotfix 1 was already installed. CISA had added the authentication-bypass flaw to its Known Exploited Vulnerabilities catalog, establishing observed exploitation rather than a theoretical risk.

The deployment model defined the response at that time. N-able said its hosted N-central service had already been mitigated and required no customer action, while supported on-premises releases had documented paths to Hotfix 2 and older installations could require an intermediate upgrade. Anyone using this historical report to make a current change should first confirm the presently supported build and upgrade path in N-able’s linked guidance.

CISA described the flaw as an authentication bypass that can lead to account takeover and said it resulted from an incomplete patch for CVE-2026-18556. That history explains why Hotfix 1 was not the end of the response: the August 6 notice required Hotfix 2 for supported on-premises installations.

Plan the update and the follow-up check

Record the installed build, the supported upgrade path, the change time and a basic post-update result. Internet exposure, authentication records and unexpected administrative activity can guide a local investigation after the fix; those environment-specific records, rather than the public advisory alone, determine whether an installation was accessed.