Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-18577.
Unlock with Pro - from £29/user/moDetect N-able N-central Authentication Bypass via Alternate Path/Channel (CVE-2026-18577) in Sumo Logic CSE
Detects exploitation attempts and successful exploitation of CVE-2026-18577, an authentication bypass vulnerability (CWE-288: Authentication Bypass Using an Alternate Path or Channel) affecting N-able N-central RMM/MSP management platform. This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog and has been actively exploited in the wild to gain unauthorized administrative access to N-central instances, which manage endpoints across MSP customer environments. Successful exploitation can lead to full takeover of the RMM console and downstream compromise of all managed endpoints. Vendor released N-central 2026.3 Hotfix 1 as mitigation on 2026-08-02.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=*ncentral* OR _sourceCategory=*iis*
| parse "* * * * * * * * * *" as date, time, s_ip, cs_method, cs_uri_stem, s_port, cs_username, c_ip, cs_useragent, sc_status
| where cs_uri_stem matches "*/api/*" or cs_uri_stem matches "*/dms2/*" or cs_uri_stem matches "*/agent/*" or cs_uri_stem matches "*/device/*" or cs_uri_stem matches "*/websvcs/*" or cs_uri_stem matches "*/soap/*"
| where cs_uri_stem matches "*admin*" or cs_uri_stem matches "*config*" or cs_uri_stem matches "*settings*"
| where sc_status = "200" or sc_status = "302"
| where isBlank(cs_username)
| timeslice 5m
| count by c_ip, cs_uri_stem, _timeslice
| where _count > 3Detects unauthenticated bursts of requests against N-central sensitive endpoints returning success codes, consistent with alternate-path authentication bypass exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Authorized scanning or synthetic monitoring hitting the same URL patterns
- Load balancer health checks
- Log parsing errors causing username field to appear blank for authenticated sessions
Other platforms for CVE-2026-18577
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate unauthenticated access to N-central admin API path
Expected signal: Web/proxy log entry showing GET request to /dms2/services/ServerEI/admin/config with empty username field and HTTP response code
- Test 2Simulate burst of unauthenticated requests to sensitive N-central paths
Expected signal: Multiple web/proxy log entries from the same source IP to distinct sensitive N-central paths within a 5-minute window, all lacking authenticated username
- Test 3Simulate unauthenticated access on Windows-hosted N-central via PowerShell
Expected signal: IIS W3C log entry recording GET request to /device/admin/config with blank cs-username field and HTTP status code
References (7)
- https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm
- https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-18577
- https://www.bleepingcomputer.com/news/security/n-able-warns-of-n-central-auth-bypass-flaw-exploited-in-attacks/
- https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-18577 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month