Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-18577.
Unlock with Pro - from £29/user/moDetect N-able N-central Authentication Bypass via Alternate Path/Channel (CVE-2026-18577) in Splunk
Detects exploitation attempts and successful exploitation of CVE-2026-18577, an authentication bypass vulnerability (CWE-288: Authentication Bypass Using an Alternate Path or Channel) affecting N-able N-central RMM/MSP management platform. This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog and has been actively exploited in the wild to gain unauthorized administrative access to N-central instances, which manage endpoints across MSP customer environments. Successful exploitation can lead to full takeover of the RMM console and downstream compromise of all managed endpoints. Vendor released N-central 2026.3 Hotfix 1 as mitigation on 2026-08-02.
MITRE ATT&CK
SPL Detection Query
index=web sourcetype=iis OR sourcetype=access_combined host=*ncentral* OR host=*n-central*
| regex uri_path="(?i)(/api/|/dms2/|/agent/|/device/|/websvcs/|/soap/).*(admin|config|user/|settings)"
| where status=200 OR status=302
| where isnull(user) OR user="" OR user="-"
| bin _time span=5m
| stats count as request_count, values(uri_path) as paths, values(http_method) as methods by src_ip, host, _time
| where request_count > 3
| sort -_timeDetects unauthenticated requests to N-central administrative or API endpoints returning success codes without a valid session, indicating potential authentication bypass exploitation of CVE-2026-18577.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate health-check or monitoring endpoints that intentionally bypass auth by design
- Load balancer or WAF probes hitting the same paths
- Misconfigured logging pipelines that drop the authenticated username field
Other platforms for CVE-2026-18577
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate unauthenticated access to N-central admin API path
Expected signal: Web/proxy log entry showing GET request to /dms2/services/ServerEI/admin/config with empty username field and HTTP response code
- Test 2Simulate burst of unauthenticated requests to sensitive N-central paths
Expected signal: Multiple web/proxy log entries from the same source IP to distinct sensitive N-central paths within a 5-minute window, all lacking authenticated username
- Test 3Simulate unauthenticated access on Windows-hosted N-central via PowerShell
Expected signal: IIS W3C log entry recording GET request to /device/admin/config with blank cs-username field and HTTP status code
References (7)
- https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm
- https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-18577
- https://www.bleepingcomputer.com/news/security/n-able-warns-of-n-central-auth-bypass-flaw-exploited-in-attacks/
- https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-18577 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month