Which versions of N-central are affected by CVE-2026-18577?

N-able N-central through version 2026.3.1 contains an authentication bypass enabling unauthenticated account takeover; publicly available exploit code exists.

Is there a public PoC exploit available for CVE-2026-18577?

Yes, a public proof-of-concept exploit is available for CVE-2026-18577. Prioritise patching immediately. EPSS: 1.5%.

How to fix or mitigate CVE-2026-18577?

Within 24 hours: Identify all N-central instances at version 2026.3.1 or earlier; immediately audit authentication logs for unauthorized account creation, privilege escalation, or suspicious login patterns. Within 7 days: Implement network segmentation restricting N-central access to authorized personnel only; enable detailed authentication logging with real-time alerting for bypass indicators (failed-then-successful auth, elevated privileges from unauthenticated sessions); restrict access by IP whitelist to known administrator locations. Within 30 days: Monitor N-able security advisories and vendor communications weekly for patch release; prepare staged patching strategy for all N-central instances; conduct comprehensive forensic analysis to confirm no exploitation has occurred in your environment.

N-central CVE-2026-18577

Q: What is the CVSS score of CVE-2026-18577?

CVE-2026-18577 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.5%.

EUVD-2026-52010 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-02 N-able

GHSA-qgcm-97x5-6q8q

Authentication Bypass N Central N Able

8.2

CVSS 4.0 · Vendor: N-able

Severity by source

Vendor (N-able) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.5 HIGH

Network auth bypass requires no privileges but AC:H reflects incomplete-patch complexity; S:C and I:L capture downstream MSP-managed endpoint reach.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L

Primary rating from Vendor (N-able).

CVSS VectorVendor: N-able

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Threat Model Generated

Aug 31, 2026 - 11:57 vuln.today

Added to CISA KEV

Aug 03, 2026 - 19:47 CISA

Analysis Generated

Aug 02, 2026 - 23:01 vuln.today

CVE Published

Aug 02, 2026 - 22:06 cve.org

HIGH 8.2

DescriptionCVE.org

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Articles & Coverage 2

POC CVE-2026-18556 & CVE-2026-18577: Authentication Bypass in N-able N-central Under Active Exploitation Aug 06, 2026 POC CVE-2026-18577: Proof-of-Concept Repository Published (Details Pending) Aug 04, 2026

AnalysisAI

Authentication bypass and account takeover in N-able N-central through version 2026.3.1 stem from an incomplete remediation of CVE-2026-18556, leaving an alternate authentication path exploitable by unauthenticated remote attackers. The vendor's CVSS 4.0 submission includes E:A (Attacked), indicating active exploitation is occurring against this incomplete patch. Despite high attack complexity (AC:H), the absence of privilege requirements and the high-value nature of RMM platforms - which provide lateral movement to thousands of managed endpoints - makes this a critical priority for MSP operators.

Technical ContextAI

N-central (CPE: cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*) is N-able's flagship remote monitoring and management (RMM) platform used by managed service providers to administer and monitor large fleets of customer endpoints. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) identifies the root cause class: the system can be accessed without valid credentials by traversing a path that was not covered by the authentication enforcement logic. In this case, the original fix for CVE-2026-18556 failed to close all such alternate paths - a classic incomplete-patch regression where the security control is applied to some code paths but not the full attack surface. The CVSS 4.0 vector confirms this is network-exploitable with no prerequisites beyond connectivity and knowledge of the bypass technique.

RemediationAI

Upgrade N-central immediately to version 2026.3 Hotfix 1, which N-able has released specifically to address this incomplete patch; release notes are at https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm. If immediate patching is not possible, restrict network access to the N-central management interface to only trusted administrator IP ranges via firewall or network access control lists - this directly counteracts the AV:N attack vector and raises the effective exploitation barrier considerably, though it does not resolve the underlying flaw. Additionally, audit N-central account logs for anomalous authentication events, particularly successful logins from unexpected source IPs or at unexpected times, as active exploitation (E:A) has been confirmed by the vendor. Do not rely on the CVE-2026-18556 patch alone as protection - this vulnerability exists precisely because that prior fix was incomplete.