Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-18556.
Unlock with Pro - from £29/user/moDetect N-able N-central Authentication Bypass via Alternate Path or Channel (CVE-2026-18556) in Sumo Logic CSE
Detects exploitation attempts of CVE-2026-18556, an authentication bypass using an alternate path or channel (CWE-288) affecting N-able N-central. The vulnerability allows an attacker to reach protected N-central functionality or APIs through an alternate path that does not enforce the same authentication controls as the primary login flow, enabling unauthorized administrative access to the RMM platform. This CVE is listed in CISA KEV as actively exploited. Detections focus on anomalous authentication patterns, direct access to administrative or agent-management endpoints without a preceding authenticated session, unexpected session/token creation, and post-exploitation activity such as new admin account creation or agent deployment from the N-central server.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=ncentral/webserver
| where (url_path matches "*api*" or url_path matches "*dms*" or url_path matches "*admin*" or url_path matches "*nagent*") and !(url_path matches "*login*") and status_code=200
| timeslice 15m
| count as req_count by src_ip, host, _timeslice
| where req_count > 5
| sort -req_countAggregates repeated successful admin/API path requests per source IP over 15-minute windows, flagging potential alternate-path authentication bypass against N-central.
Data Sources
Required Tables
False Positives & Tuning
- Internal automation scripts using API keys legitimately
- Uptime/monitoring checks
- Proxy misclassification of source IP for NAT'd clients
Other platforms for CVE-2026-18556
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate direct admin path access without prior login
Expected signal: Multiple successful (200) HTTP requests to /dms/ path from a single source IP with no corresponding SigninLogs/auth event in the same window.
- Test 2Simulate anomalous account creation via API without session cookie
Expected signal: N-central audit log entry for new admin user creation correlated with the same source IP as the earlier unauthenticated path access.
- Test 3Agent deployment task trigger simulation
Expected signal: N-central deployment/job logs showing an agent push job initiated from an unauthenticated or anomalously-authenticated session.
References (6)
- https://uptime.n-able.com/
- https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-18556
- https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-18556 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month