CVE-2026-18556
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
Description
CVE-2026-18556 is an authentication bypass vulnerability in N-able N-central that lets a remote attacker reach protected functionality through an alternate path or channel that fails to enforce the same authentication requirements. The flaw affects all N-central releases through 2026.1 and, because it requires no privileges and no user interaction, an unauthenticated attacker who can reach the management interface over the network can gain access equivalent to a legitimate user. Successful exploitation exposes sensitive data and allows unauthorized changes, undermining the security of a platform widely used by managed service providers to administer customer environments. With a CVSS score of 7.4 and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2026-18556 is an active threat that demands prompt remediation, especially given that N-central is a high-value target with broad downstream reach.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| n-able | n-central | <= 2026.1 |
References
- https://uptime.n-able.com/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18556(US Government Resource)
- https://www.n-able.com/blog/n-central-security-update-august-2-2026(Vendor Advisory)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
This weakness occurs when a system that normally requires authentication can be reached through an alternate entry point — such as a backend API, legacy endpoint, or alternative protocol — that does not enforce the same controls. In CVE-2026-18556, N-able N-central exposes such an alternate path that skips authentication, allowing an attacker to bypass the login controls that should protect the management platform.
Learn more: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
Impact Analysis
The impact of CVE-2026-18556 is significant despite requiring some attacker skill: the attack vector is network-based, so it is remotely exploitable without physical access, but the attack complexity is high, meaning an attacker must satisfy certain conditions rather than trivially firing off a request. Crucially, privileges required is none and user interaction is none, so no authentication and no victim action are needed to exploit the alternate authentication path. A successful exploit yields high confidentiality and high integrity impact while availability is unaffected, meaning an attacker can read sensitive data and tamper with the platform without necessarily disrupting service. Rated CVSS 7.4 (High), the vulnerability carries an EPSS score of roughly 0.5% (around the 40th percentile), but its presence in the CISA KEV catalog confirms that it is being exploited in the wild and should be treated as urgent regardless of the statistical estimate.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-18556 by adding it to the Known Exploited Vulnerabilities catalog, so defenders should assume attackers are already leveraging this authentication bypass against exposed N-central instances. Although the EPSS score is modest at approximately 0.5% (roughly the 40th percentile), the KEV listing overrides the statistical view: real-world exploitation has been observed. The KEV ransomware flag is currently "Unknown," but N-central's role in managing many downstream customer environments makes it an attractive foothold for follow-on attacks. Notably, the follow-up vulnerability CVE-2026-18577 demonstrates that the original fix was incomplete, so organizations relying on an early patch may still be exposed and should verify they have applied the fully corrected release.
Remediation
- Apply the N-able mitigations without delay. Per CISA's KEV required action, follow the vendor's instructions in line with BOD 26-04 patching guidance, and discontinue use of the product if mitigations are unavailable.
- Upgrade beyond the affected 2026.1 branch. All N-central versions through 2026.1 are affected; install the fixed release provided by N-able as described in their August 2, 2026 security update. Note that a follow-up flaw, CVE-2026-18577, later identified the original fix as incomplete, so ensure you deploy the fully corrected release (N-central 2026.3 Hotfix 1 or later) rather than an interim build.
- Restrict network access to the N-central management interface. Limit exposure to trusted administrative networks and place the console behind a VPN or IP allowlist so that the alternate authentication path cannot be reached by arbitrary internet hosts.
- Enforce consistent authentication across all interfaces. In line with CWE-288 guidance, ensure authentication is applied at the API/service layer rather than only the presentation layer, and audit for legacy or backend endpoints that may bypass the primary login flow.
- Review logs for signs of unauthorized access, checking authentication and administrative activity records for anomalous sessions or configuration changes that could indicate exploitation.
Technical Details
CVE-2026-18556 is an authentication bypass using an alternate path or channel (CWE-288) in N-able N-central: an entry point that does not enforce the platform's authentication requirements can be used to obtain access equivalent to an authenticated user. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N indicates the flaw is reachable over the network without authentication or user interaction, but with high attack complexity — the attacker must meet specific preconditions to traverse the alternate path successfully. Because N-central is a centralized remote monitoring and management platform, bypassing its authentication grants access to sensitive configuration and customer data (high confidentiality) and the ability to alter platform state (high integrity), while the scope remains unchanged and availability is not directly affected. The subsequently disclosed CVE-2026-18577 shows that the initial remediation for this weakness was incomplete, underscoring that the alternate-channel access path was not fully closed by the first patch.
Frequently Asked Questions
Is CVE-2026-18556 being actively exploited?
Yes. CISA has added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild. While its EPSS score is only around 0.5%, the KEV listing means real attacks have been observed and the vulnerability should be remediated urgently.
What products are affected by CVE-2026-18556?
The vulnerability affects N-able N-central in all versions through 2026.1. Organizations running any release up to and including 2026.1 should assume they are vulnerable until they apply the vendor's fix.
How do I fix CVE-2026-18556?
Apply N-able's security update following CISA's KEV guidance under BOD 26-04, and upgrade to the fully corrected release — note that the original fix was incomplete (see CVE-2026-18577), so deploy N-central 2026.3 Hotfix 1 or later. Until patched, restrict the management interface to trusted networks.
How severe is CVE-2026-18556?
It is rated High with a CVSS 3.1 base score of 7.4. The vulnerability is unauthenticated and network-exploitable with no user interaction, causing high confidentiality and integrity impact, though exploitation requires high attack complexity and availability is not affected.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.