[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH0LFaor9T64YlWqOkOyT4uoLtrnb4UjY-AZdJsyP5bs":3,"$fMzNhSZ7WxMOucAZm0g-TQTs8rSGRzOByRZHpUVJSpJc":101},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":98,"created_at":99,"updated_at":100,"published_at":63},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline","CVE-2026-18556 is an unauthenticated authentication bypass in N-central through 2026.1; CISA added it to KEV on 4 August 2026, a day after its incomplete-patch sibling CVE-2026-18577.","CISA added CVE-2026-18556, an authentication bypass in N-able N-central that allows unauthenticated administrative account takeover in versions through 2026.1, to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for US federal civilian agencies.",[10,11,12,13,14],"CVE-2026-18556","N-Able N-Central","CISA KEV","RCE","authentication bypass","# CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline\n\n*CVE-2026-18556 is an unauthenticated authentication bypass in N-central through 2026.1; CISA added it to KEV on 4 August 2026, a day after its incomplete-patch sibling CVE-2026-18577.*\n\n**Tags:** `CVE-2026-18556` `N-able N-central` `CISA KEV` `authentication bypass`\n\n> CISA added CVE-2026-18556, an authentication bypass in N-able N-central that allows unauthenticated administrative account takeover in versions through 2026.1, to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for US federal civilian agencies.\n\n---\n\n## Vulnerability details\n\n| CVE | Type | CVSS | KEV | Fixed in |\n|---|---|---|---|---|\n| CVE-2026-18556 | Authentication bypass (alternate path) | 7.4 (NVD v3.1); 8.2 (N-able v4.0) | ✅ added 4 August 2026, due 7 August | 2026.2; apply 2026.3.1.7 or later |\n| CVE-2026-18577 | Authentication bypass (incomplete patch for CVE-2026-18556) | 8.1 (NVD v3.1); 8.2 (N-able v4.0) | ✅ added 3 August 2026, due 6 August | 2026.3.1.7 (HF1), superseded by 2026.3.1.10 (HF2) |\n| CVE-2026-86218 | Pre-authentication remote code execution | 9.8 (NVD v3.1); 10.0 (N-able v4.0) | ✅ added 8 September 2026 | 2026.3.1.14 (HF4) |\n\n## CISA adds CVE-2026-18556 to KEV\n\nCISA added CVE-2026-18556 to its Known Exploited Vulnerabilities (KEV) catalog on 4 August 2026, with a remediation deadline of 7 August 2026 for US federal civilian agencies. NVD describes it as an authentication bypass using an alternate path or channel in N-able N-central, affecting versions through 2026.1. N-able describes the impact as unauthenticated administrative account takeover.\n\nNVD scores the flaw 7.4 under CVSS v3.1; N-able's CVSS v4.0 score is 8.2. It is an authentication bypass, not a remote code execution flaw in its own right, although an attacker with administrative control of an RMM server can push scripts and remote sessions to the devices it manages.\n\nCISA added the closely related CVE-2026-18577 to KEV a day earlier, on 3 August.\n\n## How the two flaws relate\n\nN-able treats N-central 2026.2, released on 28 April 2026, as the fix for CVE-2026-18556. ThreatLocker notes that the 2026.2 release notes did not mention the CVE.\n\nThe fix was incomplete. N-able saw a rise in licensing issues for on-premises customers on 31 July 2026, and its analysis of CVE-2026-18556 exposed another way to exploit the flaw. That new vector was assigned CVE-2026-18577, which NVD describes as an incomplete patch for CVE-2026-18556 allowing authentication bypass and account takeover in versions through 2026.3.1. N-able released N-central 2026.3 Hotfix 1 (build 2026.3.1.7) on 2 August 2026 and advised all customers to install it.\n\nThreatLocker's headline describes the impact as \"God-mode\" for unauthenticated users; that is ThreatLocker's characterisation, not N-able's wording.\n\n## The N-central hotfix chain\n\nN-able has since shipped four 2026.3 hotfixes:\n\n- **HF1 (build 2026.3.1.7), 2 August:** fixes CVE-2026-18577.\n- **HF2 (build 2026.3.1.10), 6 August:** supersedes HF1 with additional hardening against CVE-2026-18577 as attacker techniques evolved.\n- **HF3 (build 2026.3.1.13), September:** fixes two further flaws in N-central's internal API, CVE-2026-86206 and CVE-2026-86207.\n- **HF4 (build 2026.3.1.14), 6 September:** fixes CVE-2026-86218, a critical pre-authentication remote code execution flaw. At release N-able said it had no confirmation of exploitation in production environments; CISA added CVE-2026-86218 to KEV on 8 September.\n\nHosted N-central instances receive the fixes automatically. Self-hosted customers should move to 2026.3.1.14 (HF4) or later.\n\n## Exploitation and indicators\n\nN-able says attackers took over an administrator account and used N-central's Take Control feature to reach managed endpoints, where they registered a Windows service for a Cloudflare tunnel to keep access. N-able advised customers to look for a file named `svchost.exe` in the Documents folder on managed devices and a registered service named `Cloudflared`, and published a list of attacker IP addresses.\n\n## Key points\n\n- CVE-2026-18556 is an unauthenticated authentication bypass in N-able N-central through 2026.1, rated 7.4 by NVD (CVSS v3.1) and 8.2 by N-able (CVSS v4.0).\n- CISA added it to KEV on 4 August 2026 with a 7 August deadline for federal civilian agencies; CVE-2026-18577, an incomplete-patch bypass of it, was added on 3 August.\n- The flaw is an authentication bypass leading to administrative account takeover, not a standalone RCE.\n- Attackers used Take Control to reach managed endpoints and persisted through a `Cloudflared` service and an `svchost.exe` file in users' Documents folders.\n- N-central 2026.3 HF4 (build 2026.3.1.14) is the current fix and also closes the critical pre-auth RCE CVE-2026-86218, added to KEV on 8 September.\n\n## Further reading & sources\n\n- [IBM Langflow, Apache Tomcat, N-able RCE and auth bypass…](https:\u002F\u002Fdefend.network\u002Fbriefings\u002Fibm-langflow-tomcat-n-central-critical-cisa-kev-2026-08-06.html) (defend.network Daily Briefings)\n- [N-able N-central vulnerabilities: How to find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fn-able-n-central) (runZero)\n- [N-able N-central vulnerability grants unauthenticated users \"God-mode\"](https:\u002F\u002Fwww.threatlocker.com\u002Fblog\u002Fn-able-n-central-vulnerability-grants-unauthenticated-users-god-mode) (ThreatLocker)\n- [Attackers exploit N-able N-central flaw to reach managed endpoints (CVE-2026-18577)](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F08\u002F03\u002Fcve-2026-18577-n-able-n-central-vulnerability\u002F) (Help Net Security)\n- [N-central 2026.3 Hotfix 2: additional mitigation for CVE-2026-18577](https:\u002F\u002Fstatus.n-able.com\u002F2026\u002F08\u002F06\u002Fn-central-2026-3-hotfix-2-additional-mitigation-for-cve-2026-18577\u002F) (N-able)\n- [N-central 2026.3 Hotfix 4: CVE-2026-86218](https:\u002F\u002Fstatus.n-able.com\u002F2026\u002F09\u002F06\u002Fn-central-2026-3-hotfix-4-cve-2026-86218\u002F) (N-able)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66",{"cves":18,"malware":53,"targets":58,"timeline":64,"industries":84,"technologies":89},[19,27,32,40,46],{"id":10,"kev":20,"poc":20,"url":21,"cvss":22,"epss":23,"risk_band":24,"risk_score":25,"cvss_version":26},true,"\u002Fvulnerabilities\u002FCVE-2026-18556",8.2,0.0788,"High",70.33,"4.0",{"id":28,"kev":20,"poc":20,"url":29,"cvss":22,"epss":30,"risk_band":24,"risk_score":31,"cvss_version":26},"CVE-2026-18577","\u002Fvulnerabilities\u002FCVE-2026-18577",0.1462,75.83,{"id":33,"kev":34,"poc":20,"url":35,"cvss":36,"epss":37,"risk_band":38,"risk_score":39,"cvss_version":26},"CVE-2026-86206",false,"\u002Fvulnerabilities\u002FCVE-2026-86206",6.9,0.0112,"Medium",46.25,{"id":41,"kev":34,"poc":20,"url":42,"cvss":43,"epss":44,"risk_band":38,"risk_score":45,"cvss_version":26},"CVE-2026-86207","\u002Fvulnerabilities\u002FCVE-2026-86207",7.7,0.0125,49.58,{"id":47,"kev":20,"poc":20,"url":48,"cvss":49,"epss":50,"risk_band":51,"risk_score":52,"cvss_version":26},"CVE-2026-86218","\u002Fvulnerabilities\u002FCVE-2026-86218",10,0.1539,"Critical",89.8,[54,56],{"name":55},"Cloudflared",{"name":57},"svchost.exe",[59],{"name":60,"sector":61,"status":62,"geography":63},"N-able","IT","confirmed",null,[65,69,73,77,80],{"date":66,"event":67,"description":68},"2026-04-28","Release","Version 2026.2 released as fix for CVE-2026-18556",{"date":70,"event":71,"description":72},"2026-08-01","Advisory","N-able releases advisory for CVE-2026-18556",{"date":74,"event":75,"description":76},"2026-08-03","Kev addition","CVE-2026-18577 added to CISA KEV catalog",{"date":78,"event":75,"description":79},"2026-08-04","CVE-2026-18556 added to CISA KEV catalog",{"date":81,"event":82,"description":83},"2026-08-06","CISA KEV addition","CISA added four critical vulnerabilities to KEV",[85],{"url":86,"name":87,"slug":88},"\u002Findustries\u002Ftechnology","Technology","technology",[90,92,95],{"vendor":60,"product":91},"N-central",{"vendor":93,"product":94},"Apache","Tomcat",{"vendor":96,"product":97},"IBM","Langflow","vulnerability_disclosure","2026-09-21T12:03:34.769619+00:00","2026-10-16T12:28:18.763278+00:00",{"articles":102},[103,114,126,138],{"slug":104,"title":105,"summary":106,"tags":107,"hero_image_url":111,"story_type":112,"created_at":113},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found at least 274 internet-facing Zimbra Collaboration Suite servers compromised via CVE-2026-73570, an unauthenticated OS command injection that affects servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and lets attackers run commands as the zimbra user via crafted SMTP requests.",[108,109,13,12,110],"Zimbra","CVE-2026-73570","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","exploitation","2026-09-24T07:12:41.74195+00:00",{"slug":115,"title":116,"summary":117,"tags":118,"hero_image_url":124,"story_type":98,"created_at":125},"fortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation","Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation","Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.",[119,120,121,122,12,123],"Fortinet","FortiMail","CVE-2026-104286","Path Traversal","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation.png?v=fe5d35df3a","2026-10-17T12:03:14.799873+00:00",{"slug":127,"title":128,"summary":129,"tags":130,"hero_image_url":136,"story_type":98,"created_at":137},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004 Exploited: diffpatch API Abused to Run Shell Commands","CVE-2026-60004 is a critical remote code execution flaw in Gitea's diffpatch API, fixed in Gitea 1.27.1 on 27 July 2026. An attacker with repository write access, which open self-registration lets anyone obtain, can install a Git hook and run commands as the Gitea service account. CISA added it to its KEV catalogue on 25 August 2026 after reports of miner-like payloads on unpatched servers.",[131,132,13,133,134,135],"Gitea","CVE-2026-60004","diffpatch","Git hooks","CVSS 9.8","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81","2026-09-12T12:07:21.883073+00:00",{"slug":139,"title":140,"summary":141,"tags":142,"hero_image_url":147,"story_type":98,"created_at":148},"cisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild","Cisco confirms FMC auth-bypass CVE-2026-20079 exploited in the wild","Cisco updated its advisory for CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center, on 9 September 2026 to confirm active exploitation that its PSIRT became aware of in August. CISA added the CVE to its KEV catalogue the same day, with a 12 September 2026 due date for federal civilian agencies.",[143,144,145,12,146],"Cisco","CVE-2026-20079","FMC","auth-bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild.png?v=e25c4c61c3","2026-09-12T07:10:09.180903+00:00"]