CVE-2026-18577: N-able N-central Auth Bypass Vulnerability

CVE-2026-18577 Overview

CVE-2026-18577 is an authentication bypass vulnerability affecting N-able N-central versions through 2026.3.1. The flaw exists because the patch released for CVE-2026-18556 was incomplete, leaving an alternate path that attackers can use to bypass authentication and take over accounts. The weakness is classified under [CWE-288: Authentication Bypass Using an Alternate Path or Channel]. N-central is a widely deployed remote monitoring and management (RMM) platform used by managed service providers, making account takeover particularly consequential for downstream customers.

Critical Impact
Remote, unauthenticated attackers can bypass authentication and take over N-central accounts. CISA has added CVE-2026-18577 to the Known Exploited Vulnerabilities catalog, confirming active exploitation.

Affected Products

N-able N-central versions through 2026.3.1
N-able N-central 2026.3 (base release)
All prior branches that inherited the incomplete CVE-2026-18556 fix

Discovery Timeline

2026-08-02 - N-able publishes security update and hotfix guidance
2026-08-02 - CVE-2026-18577 published to NVD
2026-08-04 - Last updated in NVD database
2026-08-06 - EPSS scoring updated, reflecting elevated exploitation probability

Technical Details for CVE-2026-18577

Vulnerability Analysis

CVE-2026-18577 is a regression of CVE-2026-18556. The original patch closed one authentication path but left an alternate channel that reaches the same authenticated state without validating credentials. An unauthenticated attacker who can reach the N-central web interface over the network can invoke this alternate path and obtain access as an existing user, including administrative accounts.

Successful exploitation results in full account takeover. Because N-central manages agents on customer endpoints, a compromised administrator account can push configuration changes, deploy scripts, and pivot into managed environments. The vulnerability requires no user interaction and no prior privileges.

Root Cause

The root cause is an incomplete authentication check introduced by the CVE-2026-18556 remediation. The original fix validated the primary authentication endpoint but did not apply the same validation to a secondary code path that produces an equivalent session. This maps to [CWE-288], where a security-relevant function is enforced on one channel but not on a parallel one.

Attack Vector

The attack vector is network-based against the N-central management interface. An attacker sends crafted requests to the alternate authentication path exposed by the incomplete patch. No credentials, tokens, or user interaction are required. Attack complexity is elevated because the attacker must locate and correctly invoke the alternate channel, but public exploitation is already occurring per CISA KEV.

Refer to the N-able Security Update and the N-able Hotfix 1 Mitigation Advisory for vendor technical detail.

Detection Methods for CVE-2026-18577

Indicators of Compromise

Unexpected successful authentication events for administrator or service accounts without a corresponding credential submission in application logs.
New scheduled tasks, scripts, or automation policies created in N-central shortly after anomalous login events.
Outbound connections from N-central-managed endpoints to previously unseen infrastructure following configuration changes.
Requests to N-central authentication endpoints originating from unfamiliar source IP addresses or hosting-provider ranges.

Detection Strategies

Correlate N-central authentication logs with session-establishment events to surface sessions that lack a preceding credential validation step.
Alert on privilege changes, new administrative user creation, and API token issuance within N-central.
Monitor for script deployment or agent configuration pushes that occur outside change-management windows.

Monitoring Recommendations

Forward N-central application and audit logs to a centralized analytics platform such as Singularity Data Lake for retention and correlation with endpoint telemetry.
Use Singularity Endpoint to monitor managed hosts for anomalous process execution driven by N-central agents following the exploitation window.
Track logins to the N-central console from geolocations and networks not represented in historical baselines.

How to Mitigate CVE-2026-18577

Immediate Actions Required

Apply N-central 2026.3 Hotfix 1 immediately on all on-premises deployments. Vendor-hosted instances are patched by N-able.
Restrict network access to the N-central management interface to trusted administrative networks and VPN ranges only.
Rotate credentials, API tokens, and MFA seeds for all N-central accounts, prioritizing administrator and service accounts.
Audit recently created accounts, permission changes, scripts, and automation policies for evidence of takeover.

Patch Information

N-able has released N-central 2026.3 Hotfix 1 to remediate CVE-2026-18577. Full details are available in the N-able Release Notes for 2026.3 HF1. Because CVE-2026-18577 is listed in the CISA Known Exploited Vulnerabilities Catalog, federal agencies must patch within the CISA-mandated deadline.

Workarounds

If patching cannot be performed immediately, place the N-central web interface behind a network access control layer that requires authenticated VPN or zero-trust access.
Disable external internet exposure of the N-central management URL until Hotfix 1 is applied.
Increase logging verbosity on authentication endpoints and forward events to a SIEM for continuous review during the exposure window.

bash

# Verify installed N-central version after patching
# Run on the N-central server
cat /etc/n-able/n-central/version.properties | grep -i version

# Expected output should reflect 2026.3 Hotfix 1 or later