N-able N-central Authentication Bypass via Alternate Path or Channel (CVE-2026-18556)

// N-able N-central auth bypass - anomalous admin path access without prior auth event
let susTimeWindow = 1h;
WebServerLogs
| where TimeGenerated > ago(susTimeWindow)
| where ServerName has_any ("n-central", "ncentral")
| where UrlPath has_any ("/api/", "/dms/", "/admin/", "/nagent/") and UrlPath !has "/login"
| where ResponseCode == 200
| join kind=leftanti (
    SigninLogs
    | where TimeGenerated > ago(susTimeWindow)
    | where AppDisplayName has_any ("n-central","ncentral")
) on $left.ClientIP == $right.IPAddress
| summarize RequestCount=count(), Paths=make_set(UrlPath) by ClientIP, ServerName, bin(TimeGenerated, 15m)
| where RequestCount > 5
| project TimeGenerated, ClientIP, ServerName, RequestCount, Paths

index=web_proxy OR index=ncentral sourcetype=access_combined OR sourcetype=ncentral:app
| eval is_admin_path=if(match(uri_path, "(?i)(/api/|/dms/|/admin/|/nagent/)") AND NOT match(uri_path,"(?i)/login"), 1, 0)
| where is_admin_path=1 AND status=200
| stats count as req_count values(uri_path) as paths by src_ip, host, _time span=15m
| where req_count > 5
| join type=left src_ip [ search index=auth sourcetype=ncentral:auth OR sourcetype=okta OR sourcetype=azuread earliest=-1h
    | stats count as auth_count by src_ip ]
| where isnull(auth_count) OR auth_count=0
| table _time, src_ip, host, req_count, paths

sequence by source.ip with maxspan=15m
  [network where url.path : ("*/api/*", "*/dms/*", "*/admin/*", "*/nagent/*") and not url.path : "*/login*" and http.response.status_code == 200]
  [network where url.path : ("*/api/*", "*/dms/*", "*/admin/*") and http.response.status_code == 200]

SELECT sourceip, destinationip, URL, eventcount, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%web%' 
  AND (URL ILIKE '%/api/%' OR URL ILIKE '%/dms/%' OR URL ILIKE '%/admin/%' OR URL ILIKE '%/nagent/%')
  AND URL NOT ILIKE '%/login%'
  AND httpstatuscode = 200
  AND starttime > NOW() - 1 HOUR
GROUP BY sourceip, destinationip, URL
HAVING eventcount > 5
ORDER BY eventcount DESC

_sourceCategory=ncentral/webserver
| where (url_path matches "*api*" or url_path matches "*dms*" or url_path matches "*admin*" or url_path matches "*nagent*") and !(url_path matches "*login*") and status_code=200
| timeslice 15m
| count as req_count by src_ip, host, _timeslice
| where req_count > 5
| sort -req_count

rule ncentral_auth_bypass_cve_2026_18556 {
  meta:
    author = "detection-engineering"
    description = "Detects repeated access to N-central admin/API paths without prior authentication, consistent with CVE-2026-18556"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /.*(\/api\/|\/dms\/|\/admin\/|\/nagent\/).*/ nocase
    not $e.target.url = /.*login.*/ nocase
    $e.network.http.response_code = 200
    $e.principal.ip = $ip
  match:
    $ip over 15m
  condition:
    $e and #e > 5
}

#event_simpleName=HttpRequest
| ServerName=/n-?central/i
| UrlPath=/\/(api|dms|admin|nagent)\// AND UrlPath!=/login/i
| StatusCode=200
| groupBy([ClientIP, ServerName, bucket(15m)], function=([count(as=req_count)]))
| test(req_count > 5)