ZeroDayAlert

CVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.

N-able N-central Added to KEV 2026-08-04 Federal due 2026-08-07 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

N-able N-central is affected by an authentication bypass vulnerability that allows attackers to circumvent login controls via an alternate path or channel. The record does not specify which versions of N-central are vulnerable, which deployment configurations are at risk, or whether the bypass requires network proximity or can be exploited remotely. You are affected if you run N-central in any capacity.

How to check whether this touches you

  • Inventory whether your organisation runs N-able N-central anywhere: on-premises, cloud-hosted, or managed service deployments.
  • Establish whether your N-central instance is reachable from the internet or from untrusted networks; check firewall rules, network segmentation, and cloud security group settings.
  • Obtain your running version number from the N-central administrative console or API; be aware that backported security fixes may exist in patch releases not mentioned in vendor advisories.
  • Check N-able's advisory and patch guidance directly for your specific version; the CISA record does not list affected versions.

What to do

  1. Contact N-able support immediately to obtain the current remediation guidance and patch availability for your version and deployment model.
  2. If a patch is available, plan and execute deployment in line with CISA BOD 26-04 timetables (federal agencies have until 2026-08-07; non-federal organisations should treat this as urgent).
  3. If no patch is available or patching is delayed, restrict network access to N-central to trusted hosts and networks only; disable or isolate any alternate authentication channels the vendor identifies in their advisory.
  4. Enable and retain audit logging of all authentication attempts and administrative actions on N-central; set log retention to at least 90 days to support later forensic review.
  5. If your organisation cannot patch or apply mitigations, escalate to risk and security leadership to evaluate discontinuing the product in accordance with BOD 26-04.

If you find you were exposed

Exploitation of authentication bypasses typically occurs before public disclosure, so assume that any exposed N-central instance may have been accessed. Review N-central audit logs and system logs for the period from at least 90 days before the vulnerability was added to the CISA KEV catalogue (2026-08-04) through to the present, searching for successful logins from unexpected sources, creation of new administrative accounts, or unusual administrative actions. Engage your security operations and incident response teams if suspicious activity is found; log retention limitations may constrain how far back you can hunt.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-18556 is being exploited. It cannot tell you whether N-central is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →