Ransomware Incident24 Sept 2026·7 sources
N-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor
Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.
N-able N-centralCVE-2026-18577StormEncryptor+2
