IT providers’ remote management tool targeted in Australia

What happened

In August 2026 the ASD’s ACSC reported that it had observed the targeting of vulnerabilities in N-able N-central within Australia.

N-central is a remote monitoring and management (RMM) platform. Managed service providers (MSPs) and large IT departments use tools like it to see, manage, update and secure all the computers and network devices they look after.

The flaws, CVE-2026-18556 and CVE-2026-18577, are authentication bypasses that could allow unauthorised access. The ACSC said they affected all current versions, including 2026.3. Patches were released on 1 August 2026, with Hotfix 2 following on 6 August, and the ACSC urged organisations to upgrade to Hotfix 2 as a priority.

Why it matters to small businesses

An RMM tool can usually run commands and install software on every computer it manages. If attackers get into an IT provider’s RMM platform, they may be able to reach every customer of that provider at once. That’s why the ACSC specifically told small and medium businesses to talk to their MSP, even if they’ve never heard of N-central.

What to ask your IT provider

• Do you use N-able N-central or another remote management tool to manage our systems?
• If you use N-central, have you upgraded to the patched version (Hotfix 2 or later)?
• Is the management interface exposed to the internet, and if so, why?
• Have you checked for signs of compromise using the vendor’s detection scripts?
• Is MFA required for every technician who uses the tool?

Good practice regardless of the tool

• Your provider should use MFA and individual logins for all their tools.
• You should know which remote access tools are installed on your computers, and which provider controls them.
• When you change providers, make sure the old provider’s agents and access are removed.

Our guide on choosing a managed IT provider covers more questions about how providers secure their own access.

Where to get help

If you think your systems were accessed through a provider’s tools, contact the provider straight away and call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).