Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-18556.
Unlock with Pro - from £29/user/moDetect N-able N-central Authentication Bypass via Alternate Path or Channel (CVE-2026-18556) in Microsoft Sentinel
Detects exploitation attempts of CVE-2026-18556, an authentication bypass using an alternate path or channel (CWE-288) affecting N-able N-central. The vulnerability allows an attacker to reach protected N-central functionality or APIs through an alternate path that does not enforce the same authentication controls as the primary login flow, enabling unauthorized administrative access to the RMM platform. This CVE is listed in CISA KEV as actively exploited. Detections focus on anomalous authentication patterns, direct access to administrative or agent-management endpoints without a preceding authenticated session, unexpected session/token creation, and post-exploitation activity such as new admin account creation or agent deployment from the N-central server.
MITRE ATT&CK
KQL Detection Query
// N-able N-central auth bypass - anomalous admin path access without prior auth event
let susTimeWindow = 1h;
WebServerLogs
| where TimeGenerated > ago(susTimeWindow)
| where ServerName has_any ("n-central", "ncentral")
| where UrlPath has_any ("/api/", "/dms/", "/admin/", "/nagent/") and UrlPath !has "/login"
| where ResponseCode == 200
| join kind=leftanti (
SigninLogs
| where TimeGenerated > ago(susTimeWindow)
| where AppDisplayName has_any ("n-central","ncentral")
) on $left.ClientIP == $right.IPAddress
| summarize RequestCount=count(), Paths=make_set(UrlPath) by ClientIP, ServerName, bin(TimeGenerated, 15m)
| where RequestCount > 5
| project TimeGenerated, ClientIP, ServerName, RequestCount, PathsFlags source IPs reaching N-central administrative/API paths repeatedly without a corresponding authenticated sign-in event, consistent with alternate-path authentication bypass exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate API integrations or monitoring tools that use service accounts not reflected in SigninLogs
- Health-check or load-balancer probes hitting admin paths
- Misconfigured log ingestion causing IP mismatch between proxy and identity logs
Other platforms for CVE-2026-18556
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate direct admin path access without prior login
Expected signal: Multiple successful (200) HTTP requests to /dms/ path from a single source IP with no corresponding SigninLogs/auth event in the same window.
- Test 2Simulate anomalous account creation via API without session cookie
Expected signal: N-central audit log entry for new admin user creation correlated with the same source IP as the earlier unauthenticated path access.
- Test 3Agent deployment task trigger simulation
Expected signal: N-central deployment/job logs showing an agent push job initiated from an unauthenticated or anomalously-authenticated session.
References (6)
- https://uptime.n-able.com/
- https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-18556
- https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-18556 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month