CVE-2026-18577: N-able N-central Authentication Bypass (KEV)

Checked: 2026-10-30

CVE-2026-18577 is an authentication-bypass vulnerability in N-able N-central caused by an incomplete fix for the earlier CVE-2026-18556, letting a remote attacker bypass authentication and take over accounts on unpatched instances; CISA added it to KEV one day after disclosure given N-able's own confirmation of active exploitation.

Vulnerability summary

Vulnerability ID	CVE-2026-18577
CVSS score	8.1
EPSS score	0.14622
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	NVD
Published	2026-08-02T23:16:26.210

Affected components

Component	CPE	Version range
N-able N-central	cpe:2.3:a:n-able:n-central::::::::	all versions through base 2026.3 (fixed in 2026.3 Hotfix 1, build 2026.3.1.7, released 2026-08-02)

What this means

CVE-2026-18577 (CWE-288, Authentication Bypass Using an Alternate Path or Channel) affects N-able N-central, a remote-monitoring-and-management (RMM) platform used by managed service providers. NVD's record states it is the result of "an incomplete patch for CVE-2026-18556," the authentication-bypass vulnerability N-able had already confirmed was exploited in the wild for Take Control abuse and Cloudflare-tunnel persistence (NVD).

NVD's own analysis gives it a Primary CVSS v3.1 score of 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, high attack complexity, no privileges or user interaction required, full confidentiality/integrity/availability impact. N-able's own CVSS v4.0 submission scores it 8.2, and notably sets the Exploit Maturity sub-metric to E:A (Attacked) in the vector itself — an explicit, vendor-asserted signal of active exploitation baked into the score (NVD).

N-able's own status-page advisory confirms the affected range as "all N-central instances" prior to 2026.3.1, and states the fix shipped in "N-central 2026.3 Hotfix 1 (Build 2026.3.1.7)," released 2026-08-02, adding: "It is highly recommended that all partners upgrade to this hotfix ASAP to protect themselves." Hosted N-central instances receive the hotfix automatically; self-hosted deployments must upgrade manually. N-able's documented release notes confirm the same build number and date (N-able Status: N-central 2026.3 Hotfix 1 – CVE-2026-18577; N-able Documentation: 2026.3 HF1 Release Notes).

N-able's advisory also lists concrete compromise indicators for defenders to hunt for: an executable named "svchost.exe" dropped in a user's Documents folder, a registered service named "Cloudflared," and inbound connections from four specific IP addresses (173.249.252.200, 87.249.138.34, 37.19.210.32, 68.235.46.214). Any match should be treated as a likely compromise and escalated to N-able support and the owning security team immediately (N-able Status: N-central 2026.3 Hotfix 1 – CVE-2026-18577).

CISA added CVE-2026-18577 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-03, with a required-action due date of 2026-08-06 and "Forensic Triage Requirements" marked Yes, reflecting BOD 26-04 guidance for actively exploited products; known ransomware campaign use is listed as "Unknown" (catalog membership confirmed this run by exact cveID match against the raw KEV feed) (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.14622 (96.646th percentile) — notably elevated for an RMM platform patch, consistent with N-able's own "Attacked" exploit-maturity assertion (FIRST EPSS).

Any N-central deployment not yet on 2026.3 Hotfix 1 (build 2026.3.1.7 or later) should be patched immediately — self-hosted instances will not receive this automatically — and administrators should check for the compromise indicators above given N-able's confirmation of in-the-wild exploitation of this and the related CVE-2026-18556.

How to fix this class of issueThis advisory's weakness class is Authentication bypass. Our practical guide covers how to detect, fix, verify and disclose it: How to fix authentication bypass in embedded firmware.

Evidence

Authentication bypass in N-able N-central resulting from an incomplete patch for CVE-2026-18556, letting a remote attacker bypass authentication and take over accounts. — NVD
NVD Primary CVSS v3.1 score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H); N-able's own CVSS v4.0 submission (8.2) sets Exploit Maturity to Attacked (E:A). — NVD
All N-central instances prior to 2026.3.1 are affected; fixed in N-central 2026.3 Hotfix 1 (build 2026.3.1.7), released 2026-08-02; compromise indicators include a "svchost.exe" dropped in Documents, a "Cloudflared" service, and four listed IP addresses. — N-able Status: N-central 2026.3 Hotfix 1 – CVE-2026-18577
Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-03, due date 2026-08-06, forensic triage required; confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
EPSS score is 0.14622 (96.646th percentile) as of 2026-10-29. — FIRST EPSS

More advisories

CVE-2015-7755: Juniper ScreenOS Unauthorized Backdoor Authentication Bypass (KEV)CVE-2015-7755: KEV authentication bypass via a hardcoded backdoor password planted in Juniper ScreenOS, giving remote attackers admin access over SSH/Telnet. Versions, root cause and scoring sourced to NVD, CISA and public firmware analysis.CVE-2017-7921: Hikvision IP Camera Improper Authentication Bypass (KEV)CVE-2017-7921: KEV improper-authentication flaw across multiple Hikvision IP camera series lets a remote attacker escalate privileges and access video and device data without valid credentials. Versions, fix and scoring sourced to NVD, CISA ICS-CERT and Hikvision.CVE-2024-21182: Oracle WebLogic Server Unauthenticated RCE (KEV)CVE-2024-21182: KEV flaw lets an unauthenticated attacker compromise Oracle WebLogic Server over T3/IIOP; a 2024 CVE added to CISA's KEV catalog in 2026. Versions, scoring sourced to NVD, CISA and Oracle.