All news
vulnerability disclosure

EdgeProtect

CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline

CVE-2026-18556 is an unauthenticated authentication bypass in N-central through 2026.1; CISA added it to KEV on 4 August 2026, a day after its incomplete-patch sibling CVE-2026-18577.

21 September 2026
CVE-2026-18556N-Able N-CentralCISA KEVRCEauthentication bypass
CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline

At a glance

5 CVEs1 target1 industry

Vulnerabilities

CVECVSSEPSSKEVPoCPRS risk
CVE-2026-185568.27.9%ExploitedAvailable70 · High
CVE-2026-185778.214.6%ExploitedAvailable76 · High
CVE-2026-862066.91.1%-Available46 · Medium
CVE-2026-862077.71.3%-Available50 · Medium
CVE-2026-862181015.4%ExploitedAvailable90 · Critical

Targets & victims

OrganisationSectorRegionStatus
N-ableIT-confirmed

Industries

Technology

Technology affected

N-able · N-centralApache · TomcatIBM · Langflow

Malware & tooling

Cloudflaredsvchost.exe

Timeline

  1. Release

    Version 2026.2 released as fix for CVE-2026-18556

  2. Advisory

    N-able releases advisory for CVE-2026-18556

  3. Kev addition

    CVE-2026-18577 added to CISA KEV catalog

  4. Kev addition

    CVE-2026-18556 added to CISA KEV catalog

  5. CISA KEV addition

    CISA added four critical vulnerabilities to KEV

Vulnerability details

CVE Type CVSS KEV Fixed in
CVE-2026-18556 Authentication bypass (alternate path) 7.4 (NVD v3.1); 8.2 (N-able v4.0) ✅ added 4 August 2026, due 7 August 2026.2; apply 2026.3.1.7 or later
CVE-2026-18577 Authentication bypass (incomplete patch for CVE-2026-18556) 8.1 (NVD v3.1); 8.2 (N-able v4.0) ✅ added 3 August 2026, due 6 August 2026.3.1.7 (HF1), superseded by 2026.3.1.10 (HF2)
CVE-2026-86218 Pre-authentication remote code execution 9.8 (NVD v3.1); 10.0 (N-able v4.0) ✅ added 8 September 2026 2026.3.1.14 (HF4)

CISA adds CVE-2026-18556 to KEV

CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities (KEV) catalog on 4 August 2026, with a remediation deadline of 7 August 2026 for US federal civilian agencies. NVD describes it as an authentication bypass using an alternate path or channel in N-able N-central, affecting versions through 2026.1. N-able describes the impact as unauthenticated administrative account takeover.

NVD scores the flaw 7.4 under CVSS v3.1; N-able's CVSS v4.0 score is 8.2. It is an authentication bypass, not a remote code execution flaw in its own right, although an attacker with administrative control of an RMM server can push scripts and remote sessions to the devices it manages.

CISA added the closely related CVE-2026-18577 to KEV a day earlier, on 3 August.

How the two flaws relate

N-able treats N-central 2026.2, released on 28 April 2026, as the fix for CVE-2026-18556. ThreatLocker notes that the 2026.2 release notes did not mention the CVE.

The fix was incomplete. N-able saw a rise in licensing issues for on-premises customers on 31 July 2026, and its analysis of CVE-2026-18556 exposed another way to exploit the flaw. That new vector was assigned CVE-2026-18577, which NVD describes as an incomplete patch for CVE-2026-18556 allowing authentication bypass and account takeover in versions through 2026.3.1. N-able released N-central 2026.3 Hotfix 1 (build 2026.3.1.7) on 2 August 2026 and advised all customers to install it.

ThreatLocker's headline describes the impact as "God-mode" for unauthenticated users; that is ThreatLocker's characterisation, not N-able's wording.

The N-central hotfix chain

N-able has since shipped four 2026.3 hotfixes:

  • HF1 (build 2026.3.1.7), 2 August: fixes CVE-2026-18577.
  • HF2 (build 2026.3.1.10), 6 August: supersedes HF1 with additional hardening against CVE-2026-18577 as attacker techniques evolved.
  • HF3 (build 2026.3.1.13), September: fixes two further flaws in N-central's internal API, CVE-2026-86206 and CVE-2026-86207.
  • HF4 (build 2026.3.1.14), 6 September: fixes CVE-2026-86218, a critical pre-authentication remote code execution flaw. At release N-able said it had no confirmation of exploitation in production environments; CISA added CVE-2026-86218 to KEV on 8 September.

Hosted N-central instances receive the fixes automatically. Self-hosted customers should move to 2026.3.1.14 (HF4) or later.

Exploitation and indicators

N-able says attackers took over an administrator account and used N-central's Take Control feature to reach managed endpoints, where they registered a Windows service for a Cloudflare tunnel to keep access. N-able advised customers to look for a file named svchost.exe in the Documents folder on managed devices and a registered service named Cloudflared, and published a list of attacker IP addresses.

Key points

  • CVE-2026-18556 is an unauthenticated authentication bypass in N-able N-central through 2026.1, rated 7.4 by NVD (CVSS v3.1) and 8.2 by N-able (CVSS v4.0).
  • CISA added it to KEV on 4 August 2026 with a 7 August deadline for federal civilian agencies; CVE-2026-18577, an incomplete-patch bypass of it, was added on 3 August.
  • The flaw is an authentication bypass leading to administrative account takeover, not a standalone RCE.
  • Attackers used Take Control to reach managed endpoints and persisted through a Cloudflared service and an svchost.exe file in users' Documents folders.
  • N-central 2026.3 HF4 (build 2026.3.1.14) is the current fix and also closes the critical pre-auth RCE CVE-2026-86218, added to KEV on 8 September.

Further reading & sources