CVE-2026-18556: N-able N-central Authentication Bypass (KEV, Exploited)

CVE-2026-18556 is an authentication-bypass vulnerability in N-able N-central, the RMM platform MSPs use to manage client endpoints, that allowed an attacker to gain remote administrative access without authenticating, and N-able has confirmed this was actively exploited: a threat actor used the bypass to reach N-central's Take Control feature and establish Cloudflare-tunnel persistence on managed devices before N-able shipped emergency hotfixes.

CVE-2026-18556 is an Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability. NVD's description states: "Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1" (NVD).

NVD's own Primary CVSS v3.1 score is 7.4 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N — network-reachable but with high attack complexity, no privileges or user interaction required, high confidentiality and integrity impact with no availability impact. N-able's own CNA submission separately scores it 8.2 under CVSS v4.0, vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N (NVD).

N-able's own blog post dated 2026-08-10 states plainly: "A threat actor exploited a vulnerability in N-central that allowed remote administrative access without authentication," and describes the attack mechanism: the actor used the unauthorized access to abuse N-central's Take Control feature to reach managed devices, then established Cloudflare tunnels for persistence. N-able shipped Hotfix 1 (build 2026.3.1.7) on 2026-08-02 and a stronger Hotfix 2 (build 2026.3.1.10) on 2026-08-06 after finding the first fix incomplete — the incomplete-patch gap was assigned its own CVE, CVE-2026-18577. N-able recommends enforcing MFA and disabling unused support accounts as interim hardening on top of patching, and warns that applying the hotfix alone "does not remove a threat actor who may already be present" (N-able Security Update).

N-able's status-page post for Hotfix 1 separately confirms the issue affected "all N-central instances not running 2026.3.1," with hosted (NCOD) instances patched automatically and self-hosted instances required to upgrade manually (N-able Status: N-central 2026.3 Hotfix 1).

CISA added CVE-2026-18556 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-04, with a required-action due date of 2026-08-07 — a three-day window — and flags this CVE as requiring CISA's forensic-triage guidance under BOD 26-04, consistent with N-able's own warning that patching does not evict an attacker who already gained access. Known ransomware campaign use is recorded as "Unknown." Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.07882 (94.689th percentile) (FIRST EPSS).

Any organization running self-hosted N-central should confirm it is on build 2026.3.1.10 or later immediately, treat the instance as potentially already compromised given N-able's own confirmation of in-the-wild exploitation, enforce MFA, audit and disable unused support accounts, and hunt for unexpected Take Control sessions or outbound Cloudflare-tunnel connections on managed endpoints.

• Authentication bypass using an alternate path or channel in N-able N-central, affecting N-central through 2026.1 per NVD's description. — NVD
• NVD Primary CVSS v3.1 score is 7.4 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N; N-able's own CNA submission separately rates it 8.2 under CVSS v4.0. — NVD
• N-able confirmed a threat actor exploited the flaw for unauthenticated remote admin access, abused the Take Control feature, and established Cloudflare-tunnel persistence; fixed in Hotfix 2 (build 2026.3.1.10, 2026-08-06) after Hotfix 1 (2026.3.1.7, 2026-08-02) proved incomplete (the gap became CVE-2026-18577); recommends MFA and disabling unused support accounts. — N-able Security Update
• Issue affected all N-central instances not running 2026.3.1; hosted (NCOD) instances patched automatically, self-hosted instances required manual upgrade. — N-able Status: N-central 2026.3 Hotfix 1
• Added to the CISA KEV catalog on 2026-08-04, due date 2026-08-07, flagged for forensic-triage requirement under BOD 26-04, ransomware use Unknown. Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
• EPSS score is 0.07882 (94.689th percentile) as of 2026-10-28. — FIRST EPSS