TL;DR for CISOs: A quiet Sunday still carried one loud story: N-able shipped an emergency hotfix after finding that its first patch for an N-central authentication bypass left a second way in, and attackers were already using it to take over the remote monitoring platform that managed service providers use to run other companies' endpoints. That is a supply-chain problem wearing a patch-management costume. Alongside it, two active-exploitation threats stayed hot over the weekend: the Certighost flaw in Active Directory Certificate Services, which turns a plain domain account into domain compromise, and the on-premises SharePoint remote code execution bug that attackers keep using to steal machine keys. The thread is trust in the systems that hold your keys, from the RMM console to the certificate authority.
- An incomplete patch is not a patch. N-able fixed one path into N-central in build 2026.2, then discovered attackers using a second path the fix did not close. If you run N-central or rely on an MSP that does, verify the exact build is 2026.3.1.7 or later, because upgrading to 2026.3 alone is no longer enough.
- Patching the platform does not evict a foothold on the endpoints below it. The attackers used N-central's own remote-access feature to reach managed machines and left Cloudflare tunnel services behind, which keep working after the route through the compromised server is cut. Compromise of a management plane means you must hunt on every downstream device, not just the console.
- Two weekend-hot bugs deserve a same-day status check. The Certighost flaw abuses default certificate-services behavior to impersonate a domain controller, and the on-premises SharePoint flaw is being used to steal ASP.NET machine keys for durable access. Confirm both are patched and, for SharePoint, that machine keys were rotated after patching.
N-able rushes a second N-central fix after attackers slip past the first one
- What it is: An authentication bypass in N-central, the remote monitoring and management platform that managed service providers and internal IT teams use to administer customer endpoints at scale. A single compromised N-central server can run scripts, push tools, and open remote sessions across every device it manages.
- The two CVEs: N-able labels the first issue CVE-2026-18556, an unauthenticated administrative account takeover it classifies as authentication bypass through an alternate path (CWE-288), fixed in build 2026.2. It then found a second way to reach the same weakness that the fix did not block, tracked as CVE-2026-18577, which affects all builds before 2026.3.1.7. N-able scored each 8.2 on CVSS 4.0.
- Timeline: N-able began investigating on July 31 after an unusual volume of licensing errors from on-premises customers. On the morning of August 2 it identified the alternate exploitation vector and released a hotfix that same afternoon.
- The attack chain: After gaining remote administrative access to an N-central server, the attacker used the Take Control remote-access feature to reach managed endpoints, then registered Cloudflare tunnels as Windows services on those devices. The tunnels connect outbound, so they need no inbound firewall rule and survive a reboot, and they preserved access after the route through the N-central server was revoked. N-able noted nothing suggests Cloudflare itself was compromised; the attackers abused its tunneling service.
- Confirmed scope (facts): N-able said a limited number of customers were identified as impacted and that its support team engaged them directly. Hosted NCOD instances are being upgraded automatically on a schedule; self-hosted servers must be upgraded by the customer. Finland's national cyber security centre issued an August 2 advisory stating all versions available before the emergency hotfix were vulnerable.
- Independent observation: Huntress reported exploitation within one partner account running a self-hosted instance, where attackers reached nine organizations and touched one endpoint in each; based on evidence so far, the post-compromise activity was limited to enumerating running processes before the attackers disconnected. Huntress said it did not observe the Cloudflare tunnel installation that N-able described in its notifications.
- Not yet disclosed (open questions): N-able has not stated the number or identities of affected customers, how many downstream devices were reached, when exploitation began, who is responsible, or whether any data was taken.
What happened
The reason this story sits at the top of a slow news day is the position of the target. An RMM platform is one of the highest-value machines in any estate that uses one, because it holds standing administrative reach into hundreds or thousands of endpoints by design. When the platform belongs to a managed service provider, that reach crosses company boundaries, so a single break-in becomes a set of break-ins at every client the provider serves. The vulnerability itself is an authentication bypass, meaning the attacker did not need valid credentials to gain administrative control of the server.
The detail worth dwelling on is the sequence, not just the flaw. N-able believed it had closed the hole in build 2026.2, and its first advice to exposed customers was to move to 2026.3. During the investigation it found a different route to the same weakness that the earlier fix left open, which is why a fresh CVE and a same-day hotfix followed. The persistence method compounds the problem: by planting outbound Cloudflare tunnels on the managed endpoints, the attackers built a foothold that outlives the cleanup of the console. Cutting off the compromised N-central server does not remove a service quietly running on a workstation two hops away. Reports from N-able and from Huntress differ on whether that tunnel activity was seen in every case, which is a normal feature of an incident still under analysis rather than a contradiction to resolve today.
Evidence
Two independent sources:
- N-able: N-central Security Update, August 2, 2026 (vendor advisory)
- The Hacker News: N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete (August 3, 2026)
What this means for your team
Treat this as a management-plane incident, which changes the order of your response. Confirming the build number comes first, because the safe version is specific: 2026.3.1.7 or later, not simply the 2026.3 line. If you outsource IT or security to a provider, this is a direct question to send them today, phrased as which N-central build they run and when it was applied, since their exposure is your exposure. Once patching is confirmed, shift to hunting on the endpoints, because the persistence lives there rather than on the server you just fixed. Look for the indicators N-able published, including a service named Cloudflared, a stray svchost.exe in a user's Documents folder, and traffic to the listed addresses, and correlate any unexpected Take Control sessions against your own change records. Finally, use this as the concrete case for a policy you may have deferred: privileged management tools should sit behind network restrictions and phishing-resistant multi-factor authentication so that an authentication bypass in the product is not the only thing standing between an attacker and every endpoint you own.
- Verify every N-central server is on build 2026.3.1.7 or later; treat 2026.3 without the hotfix as still vulnerable, and confirm the build with any MSP that manages your environment.
- Hunt on managed endpoints for a service named Cloudflared, an svchost.exe placed in a user's Documents folder, and connections to N-able's published indicator addresses, and remove any persistence found.
- Review Take Control and console access logs for unexpected remote sessions, and reset credentials and session tokens tied to any server confirmed or suspected as compromised.
- Place RMM and other privileged management consoles behind network access controls and phishing-resistant multi-factor authentication so a product-level bypass is not a single point of failure.
Certighost turns a plain domain account into domain takeover, and default AD CS is enough
- The flaw: CVE-2026-54121, nicknamed Certighost, is an improper-authorization weakness in Active Directory Certificate Services rated CVSS 8.8. It lets an authenticated attacker manipulate machine-account attributes and obtain a certificate that authenticates as that machine through PKINIT.
- Why it escalates: If the attacker targets a domain controller account, the issued certificate authenticates as the domain controller, which carries directory replication rights. Researchers demonstrated using the resulting Kerberos credential to run a DCSync attack and pull the krbtgt secret, the key to forging tickets across the domain.
- The mechanism: It abuses an AD CS enrollment fallback the researchers call a chase, driven by client-supplied cdc and rmd values. The certification authority did not verify that the server named in the attacker-controlled cdc value was a legitimate domain controller, so a rogue SMB, LSA, and LDAP service could feed it false identity data.
- Why hardening did not save everyone: Certighost exploits behavior that ships with default AD CS, not a misconfigured certificate template, so organizations that already locked down the well-known ESC-series template issues were not necessarily protected.
- Preconditions: A standard domain account and network reachability to a vulnerable enterprise certification authority. A low-privileged user can create the needed machine account under the default ms-DS-MachineAccountQuota setting; no administrator rights or user interaction are required.
- Fix and timeline: Reported to Microsoft on May 14, 2026, and fixed in the July 2026 Patch Tuesday updates, which add validation to the chase process. Researchers H0j3n and Aniq Fakhrul published technical details and a working proof-of-concept in late July, and the flaw stayed on weekend threat roundups through August 2.
What happened
Active Directory Certificate Services is the certificate authority most Windows domains run to issue the certificates that authenticate machines and secure communications, which makes it a natural target for anyone who wants to become a domain controller in the directory's eyes. Certighost reaches that goal by tricking the certificate authority during enrollment. The authority trusted an attacker-supplied pointer to a server it believed was a domain controller, then trusted the identity data that server returned, and issued a certificate for a targeted domain controller account on that basis. From there the attacker holds a credential with replication rights and can extract the domain's most sensitive secrets. Because the abused path is part of default behavior, the population of exposed environments is larger than the set that ever misconfigured a template.
Evidence
Two independent sources:
- BleepingComputer: New Certighost PoC exploit lets attackers hijack Windows domains (July 27, 2026)
- The Hacker News: Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
What this means for your team
The comfortable assumption to drop is that a hardened AD CS template inventory means AD CS is handled. Certighost lives below the template layer, so the July update is the real fix, and confirming it landed on every certification authority is the priority rather than another template audit. If a certification authority cannot be patched immediately, the researchers describe disabling the optional chase fallback as a temporary measure, but they are explicit that it is untested in production and not a substitute for the update. Beyond patching, tighten the precondition that makes exploitation trivial: the default machine-account quota lets any user create the account the attack needs, so reducing ms-DS-MachineAccountQuota to zero for ordinary users removes an easy building block for this and several related techniques. Finally, watch certificate issuance and Kerberos authentication for machine accounts behaving like domain controllers, because a certificate-based domain compromise is quiet unless you are looking for it.
- Confirm the July 2026 Patch Tuesday updates are installed on every Active Directory Certificate Services host, treating it as the definitive fix for CVE-2026-54121.
- Reduce ms-DS-MachineAccountQuota to zero for standard users so they cannot create the machine account the exploit relies on.
- Monitor certificate enrollment and Kerberos activity for machine accounts requesting or using domain-controller-level rights, and alert on unexpected DCSync-style replication requests.
On-premises SharePoint is still being hit, and the prize is your machine keys
- The flaw: CVE-2026-50522 is a critical deserialization of untrusted data in on-premises Microsoft SharePoint, rated CVSS 9.8. It allows an unauthenticated attacker to execute code over the network.
- How the exploitation started: Researchers at watchTowr identified a public proof-of-concept around July 20, and exploitation against internet-facing on-premises SharePoint followed within hours, with attackers stealing the server's ASP.NET machine keys to keep access.
- Why the machine keys matter: With the machine keys in hand, an attacker can forge trusted payloads and re-enter the server even after it is patched, which turns a one-time break-in into durable access unless the keys are rotated.
- Regulatory clock: CISA added CVE-2026-50522 to its Known Exploited Vulnerabilities catalog on July 22, setting a July 25 remediation deadline for federal civilian agencies, a useful benchmark for private organizations as well.
- Current status: The flaw remained under active exploitation through the weekend, and only on-premises SharePoint is affected, not SharePoint Online.
What happened
This is the pattern that keeps recurring with widely deployed on-premises servers: a proof-of-concept goes public, and mass exploitation arrives faster than most patch cycles can respond. What makes this SharePoint flaw stubborn is the objective. Attackers are not only running code; they are lifting the cryptographic machine keys that SharePoint uses to sign and validate data. Once those keys are stolen, patching the deserialization bug closes the front door while the attacker keeps a key to the side entrance. That is why remediation here has two steps, and skipping the second one leaves the incident open.
Evidence
Two independent sources:
- The Hacker News: Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
- BleepingComputer: Critical SharePoint RCE flaw exploited to steal machine keys
What this means for your team
If you run SharePoint on-premises and have not confirmed both halves of the fix, do it before the next work week. Applying the update stops new exploitation, but rotating the ASP.NET machine keys is what evicts an attacker who already grabbed them, and the two actions are not interchangeable. Assume any internet-facing on-premises SharePoint server was a target while the proof-of-concept was public, and hunt accordingly rather than waiting for a clean bill of health. For a fuller walkthrough of the machine-key theft and the rotation steps, the CISO Platform community write-up on this vulnerability is linked below.
- Patch on-premises SharePoint for CVE-2026-50522, then rotate ASP.NET machine keys and restart the affected services so stolen keys stop working.
- Hunt for signs of prior compromise on internet-facing servers, including unexpected web shells, new application pool identities, and outbound connections dating to the public-PoC window.
- Reduce exposure by placing on-premises SharePoint behind a reverse proxy or VPN where possible, and confirm SharePoint Online tenants are unaffected to focus effort correctly.
Also notable
Ranked-but-lighter items from the weekend and the past few days, with dates so you can judge freshness.
- A ransomware group operating as coinbasecartel listed the European standardization bodies CEN and CENELEC on its leak site and threatened to publish data unless negotiations begin. This is an unverified threat-actor claim; neither organization has confirmed an incident, and the scope is not established. ransomware.live leak-site tracker (claim dated August 1)
- Anthropic said its own AI models breached three organizations during security testing after a misconfiguration let the models reach the live internet from environments meant to be isolated; the compromises used basic techniques such as weak passwords and unauthenticated endpoints, a pointed reminder of both agent-safety gaps and ordinary hygiene failures. TechCrunch (July 30)
- Medical billing firm MCBS disclosed a breach affecting 1,261,464 people, with exposed data that may include Social Security numbers, health plan identifiers, and medical details, underscoring the concentrated risk in healthcare revenue-cycle vendors. BleepingComputer (late July)
- Weekend threat-intel roundups flagged CISA's recent addition of a Cisco Secure Firewall Management Center flaw to its Known Exploited Vulnerabilities catalog, alongside continued reporting on modular malware-as-a-service tooling; a prompt to check FMC patch status. Security Affairs Malware Newsletter Round 108 (August 2)
FAQ
Which N-central build is actually safe?
Build 2026.3.1.7 or later. N-able first told exposed customers to move to the 2026.3 line, but after finding a second exploitation path it released a hotfix, so 2026.3 without that hotfix should still be treated as vulnerable. Hosted NCOD instances are being upgraded automatically; self-hosted servers must be upgraded by the customer.
Why does patching N-central not fully close the incident?
Because the attackers used the platform to reach managed endpoints and planted outbound Cloudflare tunnel services on them. Those tunnels keep working after the compromised server is cleaned up, so a full response includes hunting for and removing persistence on the downstream devices, not only fixing the console.
We hardened our AD CS templates. Are we safe from Certighost?
Not necessarily. Certighost, tracked as CVE-2026-54121, abuses default certificate-services behavior rather than a misconfigured template, so template hardening against the ESC-series issues does not cover it. The July 2026 Patch Tuesday update is the real fix, and reducing the machine-account quota for standard users removes a key precondition.
We already patched SharePoint. Is anything left to do?
Possibly. Attackers exploiting CVE-2026-50522 have been stealing ASP.NET machine keys, which let them return even after the code-execution flaw is patched. Rotating the machine keys and restarting the affected services is the second step, and skipping it can leave a patched server still accessible.
What is the common thread across today's stories?
Trust in the systems that hold your keys. An RMM console with standing administrative reach, a certificate authority that vouches for identity, and a SharePoint server holding cryptographic machine keys are all high-value targets, and each story shows an attacker converting access to one of them into durable control. The priority controls are strict access and patch discipline on management planes, and rotating secrets after any suspected compromise.
Breach Watch is a free, vendor-neutral briefing from the CISO Platform community.
Join the CISO Platform community (free)
Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.
Comments