Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-18556.
Unlock with Pro - from £29/user/moDetect N-able N-central Authentication Bypass via Alternate Path or Channel (CVE-2026-18556) in Splunk
Detects exploitation attempts of CVE-2026-18556, an authentication bypass using an alternate path or channel (CWE-288) affecting N-able N-central. The vulnerability allows an attacker to reach protected N-central functionality or APIs through an alternate path that does not enforce the same authentication controls as the primary login flow, enabling unauthorized administrative access to the RMM platform. This CVE is listed in CISA KEV as actively exploited. Detections focus on anomalous authentication patterns, direct access to administrative or agent-management endpoints without a preceding authenticated session, unexpected session/token creation, and post-exploitation activity such as new admin account creation or agent deployment from the N-central server.
MITRE ATT&CK
SPL Detection Query
index=web_proxy OR index=ncentral sourcetype=access_combined OR sourcetype=ncentral:app
| eval is_admin_path=if(match(uri_path, "(?i)(/api/|/dms/|/admin/|/nagent/)") AND NOT match(uri_path,"(?i)/login"), 1, 0)
| where is_admin_path=1 AND status=200
| stats count as req_count values(uri_path) as paths by src_ip, host, _time span=15m
| where req_count > 5
| join type=left src_ip [ search index=auth sourcetype=ncentral:auth OR sourcetype=okta OR sourcetype=azuread earliest=-1h
| stats count as auth_count by src_ip ]
| where isnull(auth_count) OR auth_count=0
| table _time, src_ip, host, req_count, pathsIdentifies source IPs making repeated requests to N-central admin/API endpoints without a matching authentication event in the same window, indicating potential CVE-2026-18556 exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Service accounts/integrations with auth logged in a different index not joined here
- Vulnerability scanners hitting the same endpoints
- Log timing skew causing false auth-event misses
Other platforms for CVE-2026-18556
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate direct admin path access without prior login
Expected signal: Multiple successful (200) HTTP requests to /dms/ path from a single source IP with no corresponding SigninLogs/auth event in the same window.
- Test 2Simulate anomalous account creation via API without session cookie
Expected signal: N-central audit log entry for new admin user creation correlated with the same source IP as the earlier unauthenticated path access.
- Test 3Agent deployment task trigger simulation
Expected signal: N-central deployment/job logs showing an agent push job initiated from an unauthenticated or anomalously-authenticated session.
References (6)
- https://uptime.n-able.com/
- https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-18556
- https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-18556 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month