Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.
NVD: Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
This issue affects N-central: through 2026.1.
warncomponent_extraction: Component 'N-central authentication gateway (alternate access path bypassing login controls)' matches or contains product name 'N-central' — no specific component identified
Hunting hypothesis agent
Hunt N-central auth logs for administrative sessions lacking a preceding valid login event (alternate-path bypass), then look for Take Control remote management actions or bulk API calls on N-central versions through 2026.1.
PreconditionsNetwork reachability to the N-central management interface (typically HTTPS on port 443 or custom port); no authentication required. Target must run N-central through version 2026.1. The vulnerability is an authentication bypass through an alternate access path that circumvents the standard login controls. The initial fix was incomplete (CVE-2026-18577), requiring Hotfix 1 (build 2026.3.1.7) to fully remediate. Actively exploited in the wild with attackers obtaining administrative access and leveraging built-in Take Control remote management to compromise downstream managed endpoints. agent
DeliveryNetwork (HTTPS to N-central management interface via alternate access path)
Exploit notesCVSS attack complexity: HIGH | HIGH severity (CVSS 7.4) | Active exploitation reported by N-able in the wild; initial fix was incomplete, requiring CVE-2026-18577 hotfix. No public PoC available. Horizon3.ai reverse-engineered the vulnerability and developed NodeZero Rapid Response tests. Attackers who bypass authentication gain administrative access and can leverage N-central's built-in Take Control remote management to compromise managed endpoints across the customer fleet.
SummaryN-able N-central (through version 2026.1) contains an authentication bypass (CWE-288) via an alternate access path that allows unauthenticated attackers to gain administrative access to the N-central server. Because N-central is an RMM platform managing customer infrastructure, successful exploitation grants attackers access to built-in administrative capabilities including Take Control remote management, enabling lateral movement to managed endpoints. The initial vendor remediation was incomplete (CVE-2026-18577); full fix requires Hotfix 1 (build 2026.3.1.7). Actively exploited in the wild. No public PoC identified.
Tia coverage
First reported2026-08-03
First exploit report2026-08-03
Exploit report → KEV1 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.