CVE-2026-18577
Description
CVE-2026-18577 is a high-severity authentication bypass in N-able N-central (versions <= 2026.3.1) being actively exploited in the wild.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| n-central | * | 2026.3 | vulnerable |
| n-central | 2026.3 | 2026.3 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately apply N-central 2026.3 Hotfix 1 or the latest available security update provided by N-able to address the authentication bypass logic.
Update affected systems
Verify that all N-central instances running versions up to and including 2026.3.1 are upgraded to a patched version to ensure the incomplete fix from CVE-2026-18556 is resolved.
Restrict access
Limit exposure by placing N-central management interfaces behind a VPN or restricting access to known-good IP addresses to prevent unauthorized network-based exploitation.
Monitor for exploitation
Follow CISA’s Forensics Triage Requirements to scan for indicators of compromise and review audit logs for unauthorized administrative account activity or unusual login patterns.
Detection Guidance
"Security teams should monitor N-central access logs for successful logins that bypass standard authentication flows or MFA. Look for unauthorized administrative account creation or modifications. Inspect web server logs for unusual requests to authentication endpoints that deviate from normal user behavior. Organizations should also implement network signatures to detect exploitation attempts targeting the N-central management interface, specifically focusing on patterns associated with known authentication bypass techniques."