N-central CVE-2026-18577

Exploitation requires network-level access to the N-central management interface (AV:N) and sufficient knowledge to identify and exploit the specific alternate authentication path not covered by the CVE-2026-18556 patch. No authentication is required (PR:N) and no user interaction is needed (UI:N). The high attack complexity (AC:H) means exploitation is not trivially automated - the attacker must understand the residual bypass gap in the incomplete prior patch, which requires either independent reverse engineering of the patch differential or access to published techniques. Exploitation is limited to N-central versions through 2026.3.1 - systems running 2026.3 Hotfix 1 or later are not affected. Internet-exposed N-central instances face significantly higher risk than those restricted to internal or VPN-only networks.

The CVSS 4.0 base score of 8.2 is supported by a network attack vector, no privileges required, and high confidentiality impact on the vulnerable system. The AC:H metric is the primary mitigating factor, indicating the bypass requires non-trivial exploitation technique - likely specific knowledge of what the incomplete patch missed. Critically, the CVSS 4.0 supplemental metric E:A (Attacked) confirms the vendor has evidence of active exploitation, which elevates this beyond a theoretical risk. No CISA KEV listing is reflected in the provided input data, so the exploitation confirmation comes from the vendor-submitted metric rather than independent U.S. government corroboration. The downstream blast radius amplifies the real-world risk significantly: account takeover in an RMM platform grants attackers administrative access to all endpoints under N-central management, enabling mass lateral movement. EPSS data was not provided, so probabilistic exploitation rate cannot be quantified, but the E:A signal outweighs any EPSS estimate at this stage. The VI:N and VA:N metrics in the CVSS 4.0 vector indicate no direct integrity or availability impact on the N-central server itself - impact is confined to credential/session access and downstream managed-system effects (SC:L/SI:L/SA:L).

An attacker with network access to an exposed N-central management interface sends crafted authentication requests that exploit the residual bypass left by the incomplete CVE-2026-18556 patch, bypassing credential validation via an alternate code path (CWE-288). Upon gaining session access to a privileged account, the attacker leverages N-central's native RMM capabilities - script execution, remote desktop, software deployment - to push malicious payloads to the managed endpoint fleet. Given confirmed active exploitation (E:A) and the MSP context, this scenario aligns with ransomware operators and supply-chain attackers who specifically target RMM platforms for their high lateral-movement value.