N-able N-central < 2026.3.1.10 - Authentication Bypass

Exploited in the wild. Listed by CISA on 2026-08-03; known to be used by ransomware.

criticalseverity

8.1CVSS score

14.6%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

N-able N-central versions through 2026.3.1 contain an authentication bypass that lets a remote unauthenticated attacker take over an administrator account and gain full control of the N-central server. CVE-2026-18577 is a bypass of the incomplete fix for CVE-2026-18556, so the 2026.3.1 Hotfix 1 build (2026.3.1.7) does not fully remediate it. Hotfix 2 (2026.3.1.10) supersedes Hotfix 1 and is the first fully fixed 2026.3 build.

Impact

Unauthenticated attackers gain administrative access to the RMM console and can reach every managed endpoint through Take Control. Exploited in the wild and added to the CISA Known

Fix

Upgrade on-premises N-central to 2026.3.1.10 (2026.3 Hotfix 2) or to a later release line (2026.4 or newer). Applying Hotfix 1 (2026.3.1.7) alone is not sufficient. N-able hosted environments were mitigated by the vendor and need no customer action.

How to confirm it

Send: GET {{BaseURL}}/login
Positive when: contains "class=\"ncentral\"" or "ncentralVersion" AND compare_versions(version, '< 2026.3.1.10')

Run it with nuclei: nuclei -id CVE-2026-18577 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-18577

info:
  name: N-able N-central < 2026.3.1.10 - Authentication Bypass
  author: patrick-threatmate
  severity: critical
  description: |
    N-able N-central versions through 2026.3.1 contain an authentication bypass that lets a remote unauthenticated attacker take over an administrator account and gain full control of the N-central server. CVE-2026-18577 is a bypass of the incomplete fix for CVE-2026-18556, so the 2026.3.1 Hotfix 1 build (2026.3.1.7) does not fully remediate it. Hotfix 2 (2026.3.1.10) supersedes Hotfix 1 and is the first fully fixed 2026.3 build.
  impact: |
    Unauthenticated attackers gain administrative access to the RMM console and can reach every managed endpoint through Take Control. Exploited in the wild and added to the CISA Known
  remediation: |
    Upgrade on-premises N-central to 2026.3.1.10 (2026.3 Hotfix 2) or to a later release line (2026.4 or newer). Applying Hotfix 1 (2026.3.1.7) alone is not sufficient. N-able hosted environments were mitigated by the vendor and need no customer action.
  reference:
    - https://www.n-able.com/blog/n-central-security-update-august-6-2026
    - https://status.n-able.com/2026/08/06/n-central-2026-3-hotfix-2-additional-mitigation-for-cve-2026-18577/
    - https://www.rapid7.com/blog/post/etr-cve-2026-18577-n-able-n-central-authentication-bypass-exploited-in-the-wild/
    - https://www.huntress.com/blog/n-able-vulnerability-exploitation
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18577
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18556
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2026-18577
    epss-score: 0.14622
    epss-percentile: 0.96682
    cwe-id: CWE-288
    cpe: cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: n-able
    product: n-central
    shodan-query: http.title:"N-central Login"
    fofa-query: title="N-central Login"
  tags: cve,cve2026,n-able,ncentral,auth-bypass,kev,passive,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"

    matchers-condition: and
    matchers:
      - type: word
        condition: or
        words:
          - 'class="ncentral"'
          - 'ncentralVersion'

      - type: dsl
        dsl:
          - compare_versions(version, '< 2026.3.1.10')

    extractors:
      - type: regex
        name: version
        internal: true
        group: 1
        regex:
          - 'ncentralVersion:\s*"(202\d+\.\d+\.\d+\.\d+)"'

      - type: regex
        name: ncentral_version
        group: 1
        regex:
          - 'ncentralVersion:\s*"(202\d+\.\d+\.\d+\.\d+)"'

References

Use this check only on systems you are authorised to test. Where the data comes from