🔴 CVE-2026-18556

CVE-2026-18556 is an unauthenticated authentication bypass (CWE-288, alternate path/channel) in N-able N-central, an RMM platform used by MSPs. It allows a remote, unauthenticated attacker to achieve full administrative account takeover of the N-central server over the network, and is confirmed to be actively exploited and listed in CISA KEV.

← Back to Overview
HIGH_RISK
Risk Level
8.2
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
HIGH
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-08-01

Added to CISA KEV: 2026-08-04 3 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-18556 is an authentication bypass vulnerability categorized as "Authentication bypass using an alternate path or channel" that affects the N-able N-central remote monitoring and management (RMM) platform [5][6]. The vulnerability is highly critical because it allows unauthorized actors to bypass standard authentication mechanisms, potentially leading to a full administrative account takeover [3]. This is particularly significant given the nature of N-central as a tool used by managed service providers (MSPs) to control and monitor the IT infrastructure of numerous end-customer environments.

Exploitation

  • Active Exploitation: The vulnerability has been observed in the wild, with reports confirming it has been actively exploited to target N-central deployments [2].
  • Proof-of-Concept/Exploit Availability: Publicly available information indicates that exploitation techniques have evolved, with security researchers noting that initial patches were incomplete and necessitated further hardening measures [1][4].
  • Attack Prerequisites: This is a remote, unauthenticated vulnerability. It does not require local access, prior authentication, or specific user interaction, making it highly dangerous for internet-facing instances.

Affected Products & Patches

  • Affected Versions: The vulnerability affects N-able N-central versions through 2026.3.1 [4].
  • Patch/Hotfix Availability: N-able released Hotfix 1 (2026.3.1.7) on August 2, 2026, and subsequently released Hotfix 2 (2026.3.1.10) on August 6, 2026, to address a related attack path and provide additional hardening; the latter supersedes the initial fix [1].
  • Mitigations: Organizations are strongly advised to apply the latest security updates provided by N-able immediately and perform threat hunting within their environments to detect potential indicators of compromise [2].

Impact

  • Access and Capabilities: Successful exploitation grants an attacker the ability to bypass authentication, potentially resulting in full administrative control over the N-central server [3].
  • Business Risk: For internet-facing deployments, the risk is severe as it provides an entry point for threat actors to compromise the RMM platform. Because RMM tools manage high-privilege access across multiple client networks, a single compromise can facilitate widespread lateral movement, ransomware deployment, or data exfiltration across the MSP's entire customer base.

Sources

  1. N-central Security Update – August 10, 2026 - N-able

    We published guidance the same day, registered CVE-2026-18556, and released Hotfix 1 (2026.3.1.7) on August 2, and registered CVE-2026-18577. When continued monitoring on August 6 surfaced a related attack path, we released Hotfix 2 (2026.3.1.10) the same day with additional hardening measures that…

  2. CVE-2026-18556 / CVE-2026-18577

    Learn how to protect N-able N-central from active exploitation of CVE-2026-18556 and CVE-2026-18577 with patching, threat hunting, and ... Learn how to protect N-able N-central from active exploitation of CVE-2026-18556 and CVE-2026-18577 with patching, threat hunting, and mitigation guidance.

  3. CVE-2026-18556 | Vulnerability Details

    Unauthenticated administrative account takeover. Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows ...

  4. An incomplete patch for CVE-2026-18556 allows for...

    An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1…

  5. CVE Record: CVE-2026-18556

    Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N- ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed