N-able N-central Authentication Bypass via Alternate Path/Channel (CVE-2026-18577)

let SuspiciousPaths = dynamic(["/api/", "/dms2/", "/agent/", "/device/", "/websvcs/", "/soap/"]);
let AdminIndicators = dynamic(["/admin", "/config", "/user/", "/settings"]);
W3CIISLog
| where cs_host has "ncentral" or cs_host has "n-central"
| where isnotempty(cs_uri_stem)
| where cs_uri_stem has_any (SuspiciousPaths) and cs_uri_stem has_any (AdminIndicators)
| where sc_status in (200, 302) and isempty(cs_username)
| extend AnomalousAuthBypass = iff(cs_username == "" and sc_status == 200, true, false)
| where AnomalousAuthBypass == true
| summarize RequestCount = count(), Paths = make_set(cs_uri_stem), Methods = make_set(cs_method) by cs_ip_address = c_ip, cs_host, bin(TimeGenerated, 5m)
| where RequestCount > 3
| order by TimeGenerated desc

index=web sourcetype=iis OR sourcetype=access_combined host=*ncentral* OR host=*n-central*
| regex uri_path="(?i)(/api/|/dms2/|/agent/|/device/|/websvcs/|/soap/).*(admin|config|user/|settings)"
| where status=200 OR status=302
| where isnull(user) OR user="" OR user="-"
| bin _time span=5m
| stats count as request_count, values(uri_path) as paths, values(http_method) as methods by src_ip, host, _time
| where request_count > 3
| sort -_time

sequence by source.ip with maxspan=5m
  [network where destination.port in (80, 443) and http.request.method in ("GET", "POST") and
   url.path : ("*/api/*", "*/dms2/*", "*/agent/*", "*/device/*", "*/websvcs/*", "*/soap/*") and
   http.response.status_code in (200, 302) and (user.name == null or user.name == "")]
  [network where url.path : ("*/admin*", "*/config*", "*/user/*", "*/settings*") and http.response.status_code == 200]

SELECT sourceip, destinationip, "URL", httpresponsecode, username, COUNT(*) as requestcount
FROM events
WHERE devicetype = 'IIS' OR applicationname ILIKE '%ncentral%'
AND ("URL" ILIKE '%/api/%' OR "URL" ILIKE '%/dms2/%' OR "URL" ILIKE '%/agent/%' OR "URL" ILIKE '%/device/%' OR "URL" ILIKE '%/websvcs/%' OR "URL" ILIKE '%/soap/%')
AND ("URL" ILIKE '%admin%' OR "URL" ILIKE '%config%' OR "URL" ILIKE '%settings%')
AND httpresponsecode IN (200, 302)
AND (username IS NULL OR username = '')
GROUP BY sourceip, destinationip, "URL", httpresponsecode, username
HAVING COUNT(*) > 3
LAST 24 HOURS

_sourceCategory=*ncentral* OR _sourceCategory=*iis*
| parse "* * * * * * * * * *" as date, time, s_ip, cs_method, cs_uri_stem, s_port, cs_username, c_ip, cs_useragent, sc_status
| where cs_uri_stem matches "*/api/*" or cs_uri_stem matches "*/dms2/*" or cs_uri_stem matches "*/agent/*" or cs_uri_stem matches "*/device/*" or cs_uri_stem matches "*/websvcs/*" or cs_uri_stem matches "*/soap/*"
| where cs_uri_stem matches "*admin*" or cs_uri_stem matches "*config*" or cs_uri_stem matches "*settings*"
| where sc_status = "200" or sc_status = "302"
| where isBlank(cs_username)
| timeslice 5m
| count by c_ip, cs_uri_stem, _timeslice
| where _count > 3

rule ncentral_auth_bypass_cve_2026_18577 {
  meta:
    author = "detection-engineering"
    description = "Detects potential exploitation of N-able N-central authentication bypass CVE-2026-18577"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /.*(\/api\/|\/dms2\/|\/agent\/|\/device\/|\/websvcs\/|\/soap\/).*(admin|config|settings).*/
    $e.network.http.response_code = 200 or $e.network.http.response_code = 302
    $e.principal.user.userid = ""
  match:
    $e.principal.ip over 5m
  condition:
    $e and #e > 3
}

#event_simpleName=HttpRequest
| RemotePort=443 OR RemotePort=80
| RequestURI=/.*(\/api\/|\/dms2\/|\/agent\/|\/device\/|\/websvcs\/|\/soap\/).*(admin|config|settings).*/
| StatusCode=200 OR StatusCode=302
| AuthenticatedUser="" OR !AuthenticatedUser=*
| bucket span=5m _time
| stats count(RequestURI) as requestcount by ClientIP, RequestURI, _time
| where requestcount > 3