CVE-2026-18577
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
Description
CVE-2026-18577 is an authentication bypass vulnerability in N-able N-central that stems from an incomplete patch for the earlier CVE-2026-18556 and enables both authentication bypass and full account takeover. The flaw affects N-central versions through 2026.3.1 and, because it requires no privileges and no user interaction, an unauthenticated remote attacker who can reach the platform over the network can seize control of user accounts. Successful exploitation compromises confidentiality, integrity, and availability, giving an attacker the same access as a legitimate — potentially administrative — user of this widely deployed remote management platform. With a CVSS score of 8.1 and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2026-18577 is an urgent, actively exploited threat that must be remediated by upgrading to the fully corrected N-central release.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| n-able | n-central | < 2026.3; 2026.3 |
References
- https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm(Patch, Release Notes)
- https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/(Release Notes)
- https://www.cve.org/CVERecord?id=CVE-2026-18556(VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18577(US Government Resource)
- https://www.n-able.com/blog/n-central-security-update-august-2-2026(Vendor Advisory)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
This weakness occurs when a system requiring authentication can be reached through an alternate entry point that fails to enforce the same controls. In CVE-2026-18577, the incomplete fix for CVE-2026-18556 left the alternate authentication path in N-able N-central still exploitable, allowing attackers to bypass authentication and take over accounts.
Learn more: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
Impact Analysis
The impact of CVE-2026-18577 is severe: the attack vector is network-based, so it is remotely exploitable without physical access, though the attack complexity is high, meaning the attacker must satisfy specific conditions to succeed. Because privileges required is none and user interaction is none, no authentication and no victim action are needed, and the outcome — account takeover — grants the attacker the standing of a legitimate user. Unlike its predecessor, this vulnerability carries high impact to confidentiality, integrity, and availability, so an attacker can read sensitive data, tamper with the platform, and disrupt operations. Rated CVSS 8.1 (High) with an EPSS score of roughly 4% (around the 90th percentile), and confirmed in the CISA KEV catalog as actively exploited, CVE-2026-18577 represents a high likelihood of exploitation and should be treated as an immediate priority.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-18577 by listing it in the Known Exploited Vulnerabilities catalog, so organizations should assume attackers are actively abusing this account-takeover bypass. Its EPSS score of approximately 4% (around the 90th percentile) is notably higher than that of the original CVE-2026-18556, consistent with the greater impact and the fact that the earlier fix was incomplete. The KEV ransomware flag is currently "Unknown," but the ability to take over administrative accounts on a remote management platform makes this an attractive target for follow-on intrusion and lateral movement. Because it directly chains from the incomplete patch for CVE-2026-18556, defenders who applied only the first fix remain exposed and must upgrade to the fully corrected release.
Remediation
- Apply the N-able hotfix immediately. Per CISA's KEV required action, follow the vendor's instructions in line with BOD 26-04 patching guidance, and discontinue use of the product if mitigations are unavailable.
- Upgrade to N-central 2026.3 Hotfix 1 or later. Because CVE-2026-18577 is an incomplete-patch bypass affecting versions through 2026.3.1, install the 2026.3 Hotfix 1 release (per N-able's release notes and status page) that fully mitigates the flaw — an earlier patch intended for CVE-2026-18556 is not sufficient.
- Restrict network access to the N-central management interface, placing it behind a VPN or IP allowlist so the alternate authentication path cannot be reached by untrusted internet hosts while you patch.
- Force credential and session resets after patching, since account takeover may have occurred; rotate administrative passwords, invalidate active sessions, and review for unauthorized accounts or privilege changes.
- Audit logs and enforce consistent authentication across all interfaces, examining authentication and administrative records for anomalous access and ensuring, per CWE-288 guidance, that controls are enforced at the API/service layer rather than only the presentation layer.
Technical Details
CVE-2026-18577 is an authentication bypass using an alternate path or channel (CWE-288) that arises because the fix for CVE-2026-18556 was incomplete, leaving an entry point in N-able N-central that does not enforce authentication and can be leveraged for account takeover. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H shows the flaw is network-reachable without authentication or user interaction but with high attack complexity, and — in contrast to the original issue — it now impacts availability as well as confidentiality and integrity, reflecting the deeper access that account takeover provides. Directly related to CVE-2026-18556, this vulnerability demonstrates a common pattern where an initial remediation narrows but does not fully close an alternate-channel bypass, so the underlying authentication weakness remains exploitable until the corrected 2026.3 Hotfix 1 release is applied. Because N-central centrally manages many downstream environments, taking over an account can serve as a launchpad for broader compromise.
Frequently Asked Questions
Is CVE-2026-18577 being actively exploited?
Yes. CISA has added CVE-2026-18577 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Its EPSS score of about 4% (roughly the 90th percentile) indicates an elevated likelihood of ongoing exploitation activity.
What products are affected by CVE-2026-18577?
The vulnerability affects N-able N-central in versions through 2026.3.1, including the 2026.3 branch. Because it results from an incomplete patch for CVE-2026-18556, systems that received only the earlier fix remain vulnerable.
How do I fix CVE-2026-18577?
Upgrade to N-central 2026.3 Hotfix 1 or later, which fully mitigates the flaw, following CISA's KEV guidance under BOD 26-04. After patching, reset administrative credentials and sessions and audit for unauthorized account activity, and restrict the management interface to trusted networks.
How severe is CVE-2026-18577?
It is rated High with a CVSS 3.1 base score of 8.1 — more severe than the original CVE-2026-18556 because it also impacts availability. It is unauthenticated and network-exploitable with no user interaction and enables full account takeover, though exploitation requires high attack complexity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.