N-able N-central Authentication Bypass and Account Takeover Vulnerability (CVE-2026-18577) Security Advisory

Affected Vendors

n-able

Affected Components

n-central

Published Date

2026-08-02

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

N-able N-central versions up to and including 2026.3.1

Impact

Attackers can bypass authentication and achieve full account takeover by exploiting an incomplete patch for CVE-2026-18556

Mitigation

Immediately upgrade to N-central 2026.3 Hotfix 1 or later, and restrict external access to the management interface until patched

Affected Products & Version Scope

N-able N-central versions 2026.3.1 and prior

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Apply Official Security Patch

Immediately upgrade your N-central instances to the patched version recommended by the vendor.

Target Version: N-central 2026.3 Hotfix 1 (or later)

2. Temporary Mitigations (Pre-Patch)

If immediate patching is not feasible, implement the following defensive measures:

Network Access Control (ACLs): Restrict access to the N-central management console (typically TCP port 443) from the public internet. Limit access to trusted internal IP ranges or via a secure VPN.
WAF Rules: Deploy Web Application Firewall (WAF) rules to detect and block anomalous authentication requests and session manipulation attempts.
Enhanced Log Auditing: Monitor N-central authentication logs closely for unusual login patterns, unexpected administrative session creations, or access from unrecognized IP addresses.

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild (CISA KEV), immediately apply the N-central 2026.3 Hotfix 1 update.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

CVE-2026-18577 is a critical authentication bypass vulnerability in the N-able N-central platform. This vulnerability stems from an incomplete patch for a previously addressed flaw, CVE-2026-18556.

Due to an alternate path/bypass in the authentication mechanism (CWE-288), an unauthenticated remote attacker can bypass security controls to gain unauthorized access to the system. By sending crafted network requests, the attacker can hijack active sessions or log in as any user, including high-privilege administrative accounts.

This vulnerability is actively exploited in the wild and is listed in the CISA KEV Catalog with an extremely high EPSS score of 0.94 (94%), indicating imminent threat and requiring immediate remediation.