If your organisation outsources IT to a managed service provider — as a great many Cyprus SMEs, law firms, forex brokers and shipping companies do — this one is about you as much as your MSP. CVE-2026-18577, an authentication-bypass flaw in the widely used N-able N-central remote monitoring and management (RMM) platform, is being actively exploited. It is an incomplete fix for an earlier bug, CVE-2026-18556, and it hands attackers administrative control of the very console used to manage hundreds of client endpoints.
What happened
RMM platforms like N-central are how MSPs push patches, run scripts and monitor every device they look after. The vulnerability lets an attacker bypass authentication and gain admin access to the N-central server, then pivot down into the managed endpoints: the workstations and servers of every downstream client. Investigators have observed post-exploitation persistence via rogue administrator accounts and Cloudflare tunnels, a sign that real intruders, not just researchers, are inside these systems.
Why this matters in Cyprus
The Cyprus market runs on managed IT. That efficiency comes with a concentration risk most business owners never see: a single compromised RMM console is a skeleton key to every client it touches. For a CySEC-regulated broker or a firm handling EU customer data, an intrusion that arrives through your trusted IT provider is still your reportable GDPR incident and, increasingly, your NIS2 problem — the directive explicitly extends due-diligence obligations to your supply chain and service providers. “Our MSP handles security” is not a defence a regulator will accept.
How the attack unfolds
The path is efficient and quiet: bypass auth on an exposed N-central instance, create an admin account, then use N-central’s own legitimate deployment features to run commands or install tooling across managed devices. Because the activity uses the sanctioned management channel, it blends in with normal MSP operations, which is exactly why it persists. This is the same trust-relationship abuse we hunt for when we test the boundary between providers and their clients in external network penetration testing and Active Directory penetration testing.
What you should do
- Call your MSP today. Ask, in writing, whether they run N-able N-central, whether it is patched against CVE-2026-18577/18556, and whether they have checked for rogue accounts and unexpected Cloudflare tunnels.
- Demand evidence, not assurances. Under NIS2 you are entitled — and expected — to verify your providers. Request their patch timeline and their incident-response findings.
- Monitor your own side. Watch for new privileged accounts, unusual scripts pushed to your endpoints, and outbound tunnels. Do not assume the management channel is trustworthy just because it is expected.
- Test the trust boundary. We assess how far an attacker could move from a provider foothold with internal network penetration testing, and review the cloud tenancy that RMM tools plug into via cloud configuration review.
Outsourcing IT is sensible. Outsourcing accountability is not — and under NIS2 it is no longer possible.
Why supply-chain attacks scale so fast
A management platform holds privileged access to every customer it serves. Compromise it once and the attacker inherits that access across the whole client base simultaneously, the reason supply-chain attacks deliver such disproportionate impact.
For Cyprus businesses that outsource IT, this means your security now depends on your supplier’s patching discipline. Verifying that dependency, and independently testing what a compromised supplier tool could reach in your environment, is the only way to regain assurance.
What this means for Cyprus businesses
When a managed-service platform is compromised, every customer it touches is exposed at once: a supply-chain breach. Many Cyprus businesses rely on MSPs, so a flaw like this is a shared risk with direct GDPR and NIS2 implications for Limassol and island-wide organisations.
How to reduce your exposure
- Confirm your MSP patches and hardens its platforms, and ask for evidence.
- Limit and monitor the access third-party tools hold in your environment.
- Segment MSP-managed systems and enforce least-privilege.
- Independently test what a compromised supplier could reach.
Assess third-party and multi-tenant exposure with SaaS penetration testing and external network penetration testing. Get a fixed-price quote for your Cyprus business.