Today’s Field Note

The RMM chain is on fire again. N-able confirmed CVE-2026-18577, an authentication bypass on both hosted and on-prem N-central, is being exploited in the wild, and CISA has already dropped it into KEV following customer compromises. The ugly part: it is an incomplete patch for CVE-2026-18556, so anyone who thought they closed this last round did not. Meanwhile INC Ransomware has become the dominant actor exploiting SonicWall SMA 1000 flaws, with fresh victims stacking up on their leak site since early August. And Unit 42’s Pass-ta-key research is a quiet gut-punch: malware already resident on a Windows box can hijack Google-synced passkeys and even extract private keys, no fingerprint or PIN needed. Passkeys are still worth deploying, but “phishing-resistant” does not mean “endpoint-compromise-resistant.”

Today’s Action

  • Patch N-able N-central to the version fixing CVE-2026-18577 now, and treat any server on the incomplete CVE-2026-18556 patch as potentially compromised. Hunt, do not assume.
  • Pull N-central and SonicWall SMA 1000 management interfaces off the open internet or restrict to VPN/allowlisted IPs. Both are being actively hit.
  • Review N-central and SMA 1000 logs for anomalous admin logins and account creation dating back to early August; INC moves fast once inside.
  • Confirm SonicWall SMA 1000 appliances are on the fixed firmware and rotate any credentials that touched them.
  • For high-value accounts, do not rely on Google-synced passkeys alone on managed Windows endpoints; prefer hardware security keys and prioritize EDR coverage against infostealers.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

File it under “patched” only after you have checked the logs.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.