CVE-2026-18556N-able N-central authentication bypass exploited before the first fix
What broke
N-able N-central is the remote monitoring and management platform many MSPs use to run customer estates. CVE-2026-18556 is an authentication bypass using an alternate path or channel (CWE-288) in N-central through 2026.1, per NVD. NVD scores it CVSS 3.1 7.4; N-able's CVSS 4.0 score is 8.2. N-able's timeline says Adlumin MDR detected a threat actor on July 31, 2026, and the CVE was registered on August 1, the day N-able published guidance. N-able says the flaw allowed remote administrative access "without authentication" and that a limited number of customers were affected.
The fix took two attempts. Hotfix 1 (2026.3.1.7), released August 2, addressed "the original access point." A related path stayed open and was tracked as CVE-2026-18577. Hotfix 2 (2026.3.1.10), released August 6, supersedes Hotfix 1. CISA added CVE-2026-18556 to KEV on August 4, 2026, a day after the follow-on CVE. See the breach database record.
Why it matters
An RMM console holds administrative access to every endpoint and every customer beneath it. Skipping its login means skipping the only gate between an attacker and those networks. The rating here is above the CVSS band because the impact reaches many organizations at once. It is the same shape as the SimpleHelp and ScreenConnect bugs: the remote access tool is the privileged access plane.
What to do
- Install Hotfix 2 (2026.3.1.10) or later. Hotfix 1 alone is not enough. Hosted N-central instances are upgraded by N-able.
- Enforce MFA on all N-central accounts and disable the in-product support account unless an open support case needs it.
- Hunt for N-able's indicators: an
svchost.exein a user's Documents folder, aCloudflaredservice, unusual Take Control sessions, unexpected users or password resets, and connections from the IP addresses N-able lists.
After you patch
- If a hotfix went on more than a few days after release, N-able says to treat the environment as potentially compromised. Review every user account, privilege and recent activity.
- Rotate agent enrollment keys and the credentials N-central stores for managed devices.
Sources
Related identity CVEs
Related on Start with Identity
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- CVECheck Point SmartConsole login hands an unauthenticated attacker an admin token
A flaw in the Check Point SmartConsole login process let an unauthenticated attacker obtain an application login token and sign in to the Management Server as a
- CVEConnectWise ScreenConnect auth bypass via an alternate path
ScreenConnect 23.9.7 and earlier skipped authentication on an alternate setup path (CWE-288). Attackers created admin users within hours. CISA KEV. CVSS 10.0. P
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C