CVE-2026-18556: N-able N-central authentication bypass via alternate path

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityThe flaw is an unauthenticated network-reachable authentication bypass in a management platform and is listed in CISA KEV with known exploitation and a near-term remediation deadline.

What it is

N-able N-central contains an authentication bypass (CWE-288) that lets an attacker reach protected functionality through an alternate path or channel rather than the normal login flow. The flaw affects N-central through version 2026.1, and the vendor has published a security update. Because N-central is a remote monitoring and management platform, bypassing authentication can expose managed endpoints and administrative control.

Impact

An unauthenticated attacker gains access to functionality that should require login, with high confidentiality impact per the CVSS vector. Integrity and availability impacts are not scored, so the record does not establish whether the attacker can modify configuration or disrupt managed systems.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N) and no user interaction (UI:N), so the bypass is attempted directly against the N-central service. Attack complexity is rated high (AC:H), meaning some condition or knowledge beyond a simple request is needed.

Exploitation

CVE-2026-18556 was added to CISA KEV on 2026-08-04 with a 2026-08-07 remediation due date, indicating known exploitation in the wild. EPSS is 0.40158 (98.6th percentile), and no ransomware campaign use is documented in the record.

What to do

• Apply the N-able N-central security update referenced in the vendor advisory (blog and uptime pages) as the first action.
• If patching cannot be completed immediately, follow CISA KEV required action and BOD 26-04 guidance, including discontinuing use of the product where mitigations are unavailable.
• Restrict network access to the N-central management interface to trusted management networks or VPN, and remove direct internet exposure where feasible.
• Review N-central administrative accounts, sessions and API keys for signs of unauthorized access and rotate credentials after patching.
• Track the CISA KEV due date (2026-08-07) and confirm remediation status for every internet-exposed instance.

Detection

• Hunt N-central logs for successful access to authenticated endpoints or administrative functions without a preceding successful login event.
• Alert on requests to N-central paths that bypass the normal login flow, especially from unfamiliar source IPs or user agents.
• Monitor for new or modified N-central administrative accounts, sessions or API tokens created outside change windows.
• Correlate N-central access logs with downstream managed-endpoint activity to spot post-bypass lateral movement or agent commands.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.