CVE-2026-18556 Google Chronicle · YARA-L

Detect N-able N-central Authentication Bypass via Alternate Path or Channel (CVE-2026-18556) in Google Chronicle

Detects exploitation attempts of CVE-2026-18556, an authentication bypass using an alternate path or channel (CWE-288) affecting N-able N-central. The vulnerability allows an attacker to reach protected N-central functionality or APIs through an alternate path that does not enforce the same authentication controls as the primary login flow, enabling unauthorized administrative access to the RMM platform. This CVE is listed in CISA KEV as actively exploited. Detections focus on anomalous authentication patterns, direct access to administrative or agent-management endpoints without a preceding authenticated session, unexpected session/token creation, and post-exploitation activity such as new admin account creation or agent deployment from the N-central server.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Persistence

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule ncentral_auth_bypass_cve_2026_18556 {
  meta:
    author = "detection-engineering"
    description = "Detects repeated access to N-central admin/API paths without prior authentication, consistent with CVE-2026-18556"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /.*(\/api\/|\/dms\/|\/admin\/|\/nagent\/).*/ nocase
    not $e.target.url = /.*login.*/ nocase
    $e.network.http.response_code = 200
    $e.principal.ip = $ip
  match:
    $ip over 15m
  condition:
    $e and #e > 5
}
critical severity medium confidence

Chronicle YARA-L rule correlating repeated successful accesses to N-central admin/API paths from a single IP without login, mapping to CVE-2026-18556 exploitation patterns.

Data Sources

Chronicle UDM NETWORK_HTTP events from web proxy/reverse proxy feeds

Required Tables

NETWORK_HTTP

False Positives & Tuning

  • Legitimate API automation not routed through interactive login
  • Scanner or monitoring traffic
  • NAT/proxy IP aggregation causing false grouping

Other platforms for CVE-2026-18556

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate direct admin path access without prior login

    Expected signal: Multiple successful (200) HTTP requests to /dms/ path from a single source IP with no corresponding SigninLogs/auth event in the same window.

  2. Test 2Simulate anomalous account creation via API without session cookie

    Expected signal: N-central audit log entry for new admin user creation correlated with the same source IP as the earlier unauthenticated path access.

  3. Test 3Agent deployment task trigger simulation

    Expected signal: N-central deployment/job logs showing an agent push job initiated from an unauthenticated or anomalously-authenticated session.

Last updated: 2026-08-05 Research depth: standard
References (6)

Response Playbook

Triage

  1. Verify the alert source IP against known N-central admin/integration IP allowlists to rule out benign automation.
  2. Review N-central audit logs and application logs for the affected server around the alert timeframe for new user/admin account creation, API key generation, or agent deployment tasks.
  3. Check whether the N-central instance is patched per N-able hotfix guidance referenced in status.n-able.com/2026/08/02 advisory; unpatched internet-facing instances are highest priority.
  4. Correlate the source IP with threat intel feeds and CISA KEV-related IOC lists for known exploitation infrastructure targeting this CVE.

Containment

  1. If exploitation is confirmed or suspected, immediately restrict external network access to the N-central management interface (firewall/ACL) pending patching.
  2. Rotate all N-central administrative credentials, API keys, and session tokens; force logout of all active sessions.
  3. Isolate any downstream managed endpoints/agents that received new configuration or software pushes originating from the compromised N-central instance.

Evidence Collection

  1. Preserve N-central application and web server logs, including full request/response bodies for the suspicious admin/API path requests, for forensic review.
  2. Export a list of all accounts, API keys, and agent deployment jobs created or modified during the suspected exploitation window for chain-of-custody preservation.

Escalation Criteria

  • !Escalate to incident response if new administrative accounts, API keys, or agent scripts were created that the customer/organization cannot attribute to known change activity.
  • !Escalate immediately if N-central is used to manage a large fleet of downstream client/tenant endpoints (MSP context), given the risk of lateral compromise across all managed clients.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >N-central application and web server access logs showing anomalous path access patterns
  • >N-central audit trail entries for account creation, API key issuance, and agent deployment jobs
  • >Session/token tables in the N-central database showing tokens issued without corresponding login events

Tuning Guidance

Baseline normal API/integration traffic patterns for your N-central deployment (RMM plugins, PSA integrations, monitoring tools) before enabling this detection in blocking or high-priority alerting mode. Adjust the request-count and time-window thresholds based on observed legitimate automation volume, and maintain an allowlist of known service-account IPs/tokens that legitimately access admin/API paths without interactive SSO logins. Re-tune after applying the N-able hotfix, since patched versions should eliminate the alternate-path bypass and any continued matches warrant escalation.

Hunting Queries

Broader hunting query to identify any source IP exhibiting high-volume, high-diversity access to N-central sensitive paths over a longer window, useful for retroactive threat hunting beyond the primary detection thresholds.

Hunting — KQL
kql 
WebServerLogs
| where ServerName has_any ("n-central","ncentral")
| where UrlPath has_any ("/api/","/dms/","/admin/")
| summarize RequestCount=count(), DistinctPaths=dcount(UrlPath) by ClientIP, bin(TimeGenerated, 1h)
| where RequestCount > 20 and DistinctPaths > 5
| sort by RequestCount desc
Hunting — SPL
spl 
index=web_proxy OR index=ncentral (uri_path="*api*" OR uri_path="*dms*" OR uri_path="*admin*")
| stats count as req_count dc(uri_path) as distinct_paths by src_ip, span=1h
| where req_count > 20 and distinct_paths > 5
| sort - req_count

Atomic Red Team Tests

Test 1 Simulate direct admin path access without prior login
linux

Sends an HTTP GET request directly to a simulated N-central admin/API path without establishing a prior authenticated session, mimicking the alternate-path bypass pattern.

Command

bash 
for i in $(seq 1 8); do curl -s -o /dev/null -w '%{http_code}\n' https://LAB-NCENTRAL-HOST/dms/agentDownload?token=test; sleep 1; done

Cleanup

bash 
No persistent changes made; clear local curl history if required: history -c

Expected Telemetry

Multiple successful (200) HTTP requests to /dms/ path from a single source IP with no corresponding SigninLogs/auth event in the same window.

Expected Detection

KQL and SPL detections should alert on ClientIP/src_ip exceeding the 5-request threshold within 15 minutes without a matching authentication event.

Test 2 Simulate anomalous account creation via API without session cookie
linux

Issues a raw API call to an admin account-creation endpoint using only a crafted header/token rather than a full authenticated browser session, simulating post-bypass persistence.

Command

bash 
curl -s -X POST https://LAB-NCENTRAL-HOST/api/admin/users -H 'X-Test-Bypass: 1' -d '{"username":"svc_test_bypass","role":"admin"}' -o /dev/null -w '%{http_code}\n'

Cleanup

bash 
Delete any test account created in the lab N-central instance via the admin UI or DB cleanup script; do not run against production.

Expected Telemetry

N-central audit log entry for new admin user creation correlated with the same source IP as the earlier unauthenticated path access.

Expected Detection

Hunting query and escalation criteria should flag new admin account creation without corresponding prior interactive login events.

Test 3 Agent deployment task trigger simulation
windows

Simulates triggering an agent deployment/push job through the RMM API path to validate detection of downstream lateral-movement risk from bypassed N-central access.

Command

powershell 
Invoke-WebRequest -Uri 'https://LAB-NCENTRAL-HOST/nagent/deploy' -Method POST -Headers @{'X-Test-Bypass'='1'} -Body '{"targets":["lab-endpoint-01"],"package":"test-agent"}' -UseBasicParsing

Cleanup

powershell 
Remove any test deployment job from the N-central console; verify no package was pushed to real endpoints (lab environment only).

Expected Telemetry

N-central deployment/job logs showing an agent push job initiated from an unauthenticated or anomalously-authenticated session.

Expected Detection

Escalation criteria trigger on agent deployment activity correlated with unauthenticated admin path access, per the containment and evidence-collection playbook steps.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1072Software Deployment Tools

Same Tactic: Initial Access

Popular Detections