Incomplete Patch for CVE-2026-18556 Leaves N-able N-central Exposed to New Auth Bypass (CVE-2026-18577), Added to CISA KEV

CISA has added CVE-2026-18577, an authentication bypass using an alternate path or channel in N-able N-central, to its Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation. According to N-able's release notes, this flaw exists because the fix for a prior vulnerability, CVE-2026-18556, was incomplete — attackers can reportedly use an alternate path to bypass authentication and take over accounts in N-central.

Why It Matters

N-central is a remote monitoring and management (RMM) platform used heavily by managed service providers (MSPs) to administer client environments at scale. Authentication bypass and account takeover in an RMM platform is a high-impact issue: successful exploitation could give an attacker administrative reach into the endpoints and networks that N-central manages, not just the N-central server itself. Because the flaw stems from an incomplete prior patch, organizations that already remediated CVE-2026-18556 may incorrectly assume they are no longer exposed.

What Defenders Should Do Now

• Apply the update referenced in N-able's N-central 2026.3 HF1 release notes as soon as possible; treat the earlier CVE-2026-18556 patch as insufficient on its own.
• Review N-central authentication and admin account logs for anomalous logins, especially any bypassing expected auth flows or originating from unexpected source IPs.
• Audit for unexpected new or modified administrative/service accounts within N-central, and review any recent changes to managed-device configurations pushed from the platform.
• Given the KEV listing confirms active exploitation, prioritize this patch above routine maintenance windows, particularly for MSPs and organizations exposing N-central management interfaces to the internet.
• Monitor for follow-on activity consistent with RMM compromise, such as unusual remote-access tool deployment or lateral movement originating from the N-central server.

This is developing intelligence based on a same-day CISA KEV addition; specifics on exploitation techniques, scope, and indicators of compromise were not detailed in the available reporting. Known ransomware use of this vulnerability is currently listed as unknown. For the authoritative technical details and patch information, see N-able's N-central 2026.3 HF1 release notes.