Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-18556.
Unlock with Pro - from £29/user/moDetect N-able N-central Authentication Bypass via Alternate Path or Channel (CVE-2026-18556) in Elastic Security
Detects exploitation attempts of CVE-2026-18556, an authentication bypass using an alternate path or channel (CWE-288) affecting N-able N-central. The vulnerability allows an attacker to reach protected N-central functionality or APIs through an alternate path that does not enforce the same authentication controls as the primary login flow, enabling unauthorized administrative access to the RMM platform. This CVE is listed in CISA KEV as actively exploited. Detections focus on anomalous authentication patterns, direct access to administrative or agent-management endpoints without a preceding authenticated session, unexpected session/token creation, and post-exploitation activity such as new admin account creation or agent deployment from the N-central server.
MITRE ATT&CK
Elastic Detection Query
sequence by source.ip with maxspan=15m
[network where url.path : ("*/api/*", "*/dms/*", "*/admin/*", "*/nagent/*") and not url.path : "*/login*" and http.response.status_code == 200]
[network where url.path : ("*/api/*", "*/dms/*", "*/admin/*") and http.response.status_code == 200]Detects a sequence of successful accesses to N-central administrative or agent-management paths from the same source IP within a short window, bypassing the expected login flow.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate multi-step admin sessions with valid tokens not distinguishable by URL alone
- API health checks
- Third-party monitoring integrations
Other platforms for CVE-2026-18556
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate direct admin path access without prior login
Expected signal: Multiple successful (200) HTTP requests to /dms/ path from a single source IP with no corresponding SigninLogs/auth event in the same window.
- Test 2Simulate anomalous account creation via API without session cookie
Expected signal: N-central audit log entry for new admin user creation correlated with the same source IP as the earlier unauthenticated path access.
- Test 3Agent deployment task trigger simulation
Expected signal: N-central deployment/job logs showing an agent push job initiated from an unauthenticated or anomalously-authenticated session.
References (6)
- https://uptime.n-able.com/
- https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-18556
- https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-18556 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month