Detect N-able N-central Authentication Bypass via Alternate Path/Channel (CVE-2026-18577) in CrowdStrike LogScale
Detects exploitation attempts and successful exploitation of CVE-2026-18577, an authentication bypass vulnerability (CWE-288: Authentication Bypass Using an Alternate Path or Channel) affecting N-able N-central RMM/MSP management platform. This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog and has been actively exploited in the wild to gain unauthorized administrative access to N-central instances, which manage endpoints across MSP customer environments. Successful exploitation can lead to full takeover of the RMM console and downstream compromise of all managed endpoints. Vendor released N-central 2026.3 Hotfix 1 as mitigation on 2026-08-02.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=HttpRequest
| RemotePort=443 OR RemotePort=80
| RequestURI=/.*(\/api\/|\/dms2\/|\/agent\/|\/device\/|\/websvcs\/|\/soap\/).*(admin|config|settings).*/
| StatusCode=200 OR StatusCode=302
| AuthenticatedUser="" OR !AuthenticatedUser=*
| bucket span=5m _time
| stats count(RequestURI) as requestcount by ClientIP, RequestURI, _time
| where requestcount > 3Detects unauthenticated HTTP requests to N-central sensitive administrative/API endpoints returning success responses via CrowdStrike network telemetry, consistent with CVE-2026-18577 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Automated internal integrations lacking populated authenticated user field
- Authorized security scanning tools
- Proxy or load balancer health probes recorded without user context
Other platforms for CVE-2026-18577
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate unauthenticated access to N-central admin API path
Expected signal: Web/proxy log entry showing GET request to /dms2/services/ServerEI/admin/config with empty username field and HTTP response code
- Test 2Simulate burst of unauthenticated requests to sensitive N-central paths
Expected signal: Multiple web/proxy log entries from the same source IP to distinct sensitive N-central paths within a 5-minute window, all lacking authenticated username
- Test 3Simulate unauthenticated access on Windows-hosted N-central via PowerShell
Expected signal: IIS W3C log entry recording GET request to /device/admin/config with blank cs-username field and HTTP status code
References (7)
- https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm
- https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-18577
- https://www.bleepingcomputer.com/news/security/n-able-warns-of-n-central-auth-bypass-flaw-exploited-in-attacks/
- https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html
Response Playbook
Triage
- Identify all internet-facing and internally-exposed N-central server instances in the environment and confirm current patch level against N-central 2026.3 Hotfix 1.
- Review N-central application and IIS/web server logs for unauthenticated requests to admin, API, agent, and device management endpoints matching the detection query timeframe.
- Cross-reference source IPs generating anomalous unauthenticated requests against known scanner/threat intel IP lists and internal asset inventory to rule out authorized activity.
- Check N-central user/admin account list for newly created accounts, modified permissions, or unexpected API key generation that may indicate successful exploitation.
Containment
- Immediately apply N-central 2026.3 Hotfix 1 or the latest vendor-supplied patch; if patching is not immediately possible, restrict network access to the N-central management interface to trusted admin IP ranges only.
- Isolate the N-central server from managed endpoint communication channels if compromise is confirmed, and rotate all N-central service account credentials, API keys, and agent installation tokens.
Evidence Collection
- Preserve N-central application logs, IIS/web server access logs, and database audit logs covering the suspected exploitation window for forensic analysis.
- Export a full list of managed endpoints, agent deployment jobs, and script/task execution history from N-central to identify any unauthorized commands pushed to downstream managed devices.
Escalation Criteria
- !Escalate to incident response immediately if evidence shows new administrative accounts, modified user permissions, or API keys created outside of known change windows.
- !Escalate to a full MSP-wide incident if there is evidence of unauthorized script/task deployment to managed endpoints via N-central, given the platform's downstream blast radius across all managed customer environments.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
N-central application server access logs and audit trail entries showing unauthenticated administrative actions - >
IIS/reverse proxy web server logs (W3C extended log format) covering the affected N-central web tier - >
N-central database audit records for user/account table modifications and API key generation events
Tuning Guidance
Baseline legitimate unauthenticated endpoints (e.g., health checks, public agent-download pages) before enabling in blocking/alerting mode, and exclude known monitoring/synthetic transaction source IPs. Tighten the request-count threshold based on observed environment traffic volume; low-traffic N-central instances should lower the threshold to 1-2 requests to catch low-and-slow exploitation attempts, given this is a KEV-listed, actively exploited vulnerability.
Hunting Queries
Broad hunt for any unauthenticated API access to N-central over the past 30 days, to surface exploitation attempts predating detection deployment.
W3CIISLog
| where cs_host has_any ("ncentral", "n-central")
| where cs_uri_stem has "/api/" and isempty(cs_username)
| summarize count() by c_ip, cs_uri_stem, bin(TimeGenerated, 1h)
| order by count_ descindex=web (host=*ncentral* OR host=*n-central*) uri_path="*/api/*" (user="" OR user="-")
| bin _time span=1h
| stats count by src_ip, uri_path, _time
| sort -countAtomic Red Team Tests
Sends an unauthenticated HTTP GET request to a simulated N-central admin/API path to validate detection logic without exploiting an actual vulnerability.
Command
curl -s -o /dev/null -w '%{http_code}' -H 'User-Agent: atomic-test' 'https://lab-ncentral.local/dms2/services/ServerEI/admin/config' --insecureCleanup
No persistent changes made; clear local curl cache if configured: rm -f ~/.curl_history 2>/dev/null || trueExpected Telemetry
Web/proxy log entry showing GET request to /dms2/services/ServerEI/admin/config with empty username field and HTTP response code
Expected Detection
SIEM detection rule fires on unauthenticated request to N-central admin/API path matching sensitive path patterns
Generates multiple rapid unauthenticated requests to different sensitive N-central endpoints to trigger the request-count threshold in the detection logic within a lab environment.
Command
for path in /api/config /dms2/agent/settings /websvcs/admin /soap/user/settings; do curl -s -o /dev/null -H 'User-Agent: atomic-test' "https://lab-ncentral.local${path}" --insecure; sleep 1; doneCleanup
No persistent state created on target; no cleanup required beyond clearing local shell history if desiredExpected Telemetry
Multiple web/proxy log entries from the same source IP to distinct sensitive N-central paths within a 5-minute window, all lacking authenticated username
Expected Detection
Detection rule aggregation threshold (request_count > 3) triggers an alert for the source IP within the bin window
Uses PowerShell Invoke-WebRequest to simulate unauthenticated requests against a lab N-central instance's device management endpoint to validate Windows/IIS-side logging and detection.
Command
Invoke-WebRequest -Uri 'https://lab-ncentral.local/device/admin/config' -Method GET -UseBasicParsing -Headers @{'User-Agent'='atomic-test'} -SkipCertificateCheckCleanup
No persistent changes made on target system; no cleanup steps requiredExpected Telemetry
IIS W3C log entry recording GET request to /device/admin/config with blank cs-username field and HTTP status code
Expected Detection
KQL detection rule against W3CIISLog identifies the unauthenticated request matching suspicious path and admin indicator patterns