N-able Warns of Authentication Bypass Flaw Exploited in Attacks N-able has issued a warning about a security vulnerability affecting its N-central servers, which allows attackers to bypass authentication mechanisms and gain unauthorized access to systems managed by the platform. The flaw, identified as CVE-2026-18577, was disclosed on August 1st after the vendor detected active exploitation of the vulnerability. The company launched an investigation that uncovered additional security concerns impacting all versions of N-central, its flagship Remote Monitoring and Management (RMM) platform. The vulnerability stems from an incomplete patch for CVE-2026-18576, another authentication bypass flaw that affected N-central versions up to 2026.1. Both vulnerabilities could enable threat actors to take over administrative accounts, potentially granting them control over the entire RMM platform. N-able released a hotfix, version 2026.3.1.7, to address the issue, which is required for all N-central instances running versions prior to 2026.3. Hosted deployments have already received the update, while on-premises customers must apply it manually. N-central is an RMM platform used by managed service providers (MSPs) and corporate IT departments to manage large clusters of multi-OS systems and network devices. Compromising these servers could allow attackers to extend their reach beyond N-able’s direct customers, posing a significant risk to the broader ecosystem. The product was previously targeted in zero-day attacks that prompted the Cybersecurity and Infrastructure Security Agency (CISA) to issue an urgent alert. Similar incidents have been reported against other RMM platforms, including Kaseya VSA, ConnectWise ScreenConnect, SimpleHelp, and SolarWinds Orion.#cisa #n_able #n_central #cve_2026_18577 #cve_2026_18576
Agentic AI Used to Conduct Ransomware Attack via Langflow A threat actor exploited a critical vulnerability in the open-source Langflow framework to execute an agentic ransomware attack, according to a report by cloud security firm Sysdig. The attack, attributed to a group dubbed JadePuffer, leveraged a flaw in Langflow—a Python-based tool for building large language model (LLM)-driven applications—to gain unauthorized access to an organization’s systems and deploy ransomware. The breach highlights the growing risks posed by AI-driven cyber operations and the vulnerabilities in widely used open-source tools. The attack began when JadePuffer exploited CVE-2025-3248, a critical authentication flaw in Langflow disclosed in April 2025. This vulnerability, which received a CVSS score of 9.8, allowed attackers to execute arbitrary Python code on the host running Langflow. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) flagged the flaw as being actively exploited in early May. By exploiting this vulnerability, the threat actor gained code execution privileges, enabling them to probe the system for sensitive information. During the initial phase of the attack, JadePuffer used the LLM to conduct reconnaissance, scanning the network for secrets such as API keys, cloud credentials, cryptocurrency wallets, configuration files, and database credentials. The attackers then dumped the Postgres database hosted by Langflow to extract these secrets, scanned internal network addresses, and identified MinIO services for further credential extraction. A cron job was deployed to maintain persistent access to the Langflow server. Notably, the LLM adapted its actions in real time to complete tasks, extract credentials from different file types, and log into discovered endpoints.#langflow #jadepuffer #sysdig #cisa #nacos
