Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-18577.
Unlock with Pro - from £29/user/moDetect N-able N-central Authentication Bypass via Alternate Path/Channel (CVE-2026-18577) in CrowdStrike LogScale
Detects exploitation attempts and successful exploitation of CVE-2026-18577, an authentication bypass vulnerability (CWE-288: Authentication Bypass Using an Alternate Path or Channel) affecting N-able N-central RMM/MSP management platform. This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog and has been actively exploited in the wild to gain unauthorized administrative access to N-central instances, which manage endpoints across MSP customer environments. Successful exploitation can lead to full takeover of the RMM console and downstream compromise of all managed endpoints. Vendor released N-central 2026.3 Hotfix 1 as mitigation on 2026-08-02.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=HttpRequest
| RemotePort=443 OR RemotePort=80
| RequestURI=/.*(\/api\/|\/dms2\/|\/agent\/|\/device\/|\/websvcs\/|\/soap\/).*(admin|config|settings).*/
| StatusCode=200 OR StatusCode=302
| AuthenticatedUser="" OR !AuthenticatedUser=*
| bucket span=5m _time
| stats count(RequestURI) as requestcount by ClientIP, RequestURI, _time
| where requestcount > 3Detects unauthenticated HTTP requests to N-central sensitive administrative/API endpoints returning success responses via CrowdStrike network telemetry, consistent with CVE-2026-18577 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Automated internal integrations lacking populated authenticated user field
- Authorized security scanning tools
- Proxy or load balancer health probes recorded without user context
Other platforms for CVE-2026-18577
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate unauthenticated access to N-central admin API path
Expected signal: Web/proxy log entry showing GET request to /dms2/services/ServerEI/admin/config with empty username field and HTTP response code
- Test 2Simulate burst of unauthenticated requests to sensitive N-central paths
Expected signal: Multiple web/proxy log entries from the same source IP to distinct sensitive N-central paths within a 5-minute window, all lacking authenticated username
- Test 3Simulate unauthenticated access on Windows-hosted N-central via PowerShell
Expected signal: IIS W3C log entry recording GET request to /device/admin/config with blank cs-username field and HTTP status code
References (7)
- https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm
- https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-18577
- https://www.bleepingcomputer.com/news/security/n-able-warns-of-n-central-auth-bypass-flaw-exploited-in-attacks/
- https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-18577 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month