CVE-2026-18556

What is N-able N-central?

N-central is N-able's remote monitoring and management (RMM) platform, used chiefly by managed service providers. One N-central server monitors, patches, scripts against, and remotely controls every endpoint across every client an MSP serves — frequently thousands of machines belonging to dozens of unrelated organizations.

The risk concentration is the point. An attacker who takes over an N-central administrator account does not need to move laterally; the platform's normal function already grants administrative remote control of every downstream customer. The victims of an N-central compromise are usually not the organization that runs it.

Overview

CVE-2026-18556 is an authentication bypass using an alternate path or channel in N-able N-central, allowing an unauthenticated remote attacker to bypass authentication. NVD scores it CVSS 7.4 (v3.1); N-able scores it 8.2 under CVSS v4.0.

This is the original flaw in a pair. N-able patched it in release 2026.2 — but that patch addressed one route to the underlying authentication-logic defect rather than the defect itself. Attackers found a second route, which became CVE-2026-18577 and was exploited as a zero-day in early August 2026.

The two are best understood as a single incident. CVE-2026-18577 carries the confirmed in-the-wild exploitation and the published indicators of compromise; this entry is the flaw whose incomplete remediation made that possible. Both are fixed by the same build, so there is one remediation action, not two.

CISA added this CVE on 2026-08-04, one day after adding CVE-2026-18577, with a BOD 26-04 deadline of 2026-08-07.

Affected Versions

The 2026.2 release is the important nuance: it was intended to fix this CVE and did close the originally-reported path, but left the underlying defect reachable by another route. Do not treat 2026.2 as remediated. Deploy Hotfix 2 (2026.3.1.10).

Cloud-hosted (NCOD) instances were patched automatically by N-able. Self-hosted deployments require manual action.

Technical Details

The specific endpoint and alternate path have not been publicly disclosed. N-able, Horizon3.ai, Rapid7, and Huntress have all withheld the mechanical detail, given the number of unpatched self-hosted instances and the MSP-scale blast radius. Details attributed to this CVE elsewhere should be treated as unverified.

What is established:

• Classification: CWE-288, authentication bypass using an alternate path or channel — an unauthenticated request reaches protected functionality via a code path that does not enforce the authentication check.
• Outcome: authentication bypass on the N-central web interface; in the companion CVE, this escalates to full administrative account takeover.
• Attack characteristics: unauthenticated, no user interaction, network vector, single-stage.
• Scope: both cloud-hosted (NCOD) and on-premises deployments.

The incomplete-patch relationship is the substantive technical lesson here. The 2026.2 fix blocked a path rather than repairing the authentication logic that the path led to. When a fix is scoped to the reported reproduction steps instead of the underlying defect, the defect stays reachable — and in this case attackers found the second route before defenders did, turning a patched vulnerability back into a zero-day.

Discovery

Not researcher-reported. N-able discovered the exploitation through incident response, opening an investigation on 2026-07-31 after unusual licensing errors surfaced — an operational anomaly rather than a security alert. N-able's timeline credits Adlumin MDR detection.

Horizon3.ai subsequently published attack research covering both CVEs, but was not the original discoverer. The exploitation that triggered the investigation was of the companion flaw, CVE-2026-18577.

Exploitation Context

CISA added this CVE to the KEV catalog on 2026-08-04, one day after CVE-2026-18577, indicating exploitation activity associated with the pair.

The confirmed in-the-wild exploitation, published indicators of compromise, and observed attacker TTPs are documented under CVE-2026-18577 — the bypass that was actually used against customers. In summary:

• Exploitation confirmed from 2026-08-01; no threat actor attribution published, no ransomware link disclosed.
• Activity was reconnaissance-flavoured: domain controller targeting, process enumeration, rapid lateral movement, no confirmed data theft.
• Post-exploitation used N-central's own Take Control remote-session feature to reach managed endpoints — feature abuse, not a further vulnerability.
• Persistence via Cloudflare Tunnel (cloudflared) deployed as a Windows service on managed endpoints, which survives revocation of N-central access.
• Huntress documented one compromised self-hosted partner instance leading to nine downstream organizations accessed, and reported 55.6% of reachable cloud servers still unpatched at initial assessment.
• N-able describes a "limited number" of affected customers without publishing a count.

Full IOC lists — attacker IP addresses, domains, host artifacts, and relevant Windows Event IDs — are on the CVE-2026-18577 page.

Remediation

1. Apply 2026.3 Hotfix 2 (build 2026.3.1.10). This is a single action that remediates both this CVE and CVE-2026-18577. Hotfix 1 (2026.3.1.7) also closes both but is superseded.
2. Do not treat release 2026.2 as remediated. It was the incomplete fix for this CVE and leaves the underlying defect reachable.
3. Self-hosted instances must be patched manually — only cloud-hosted (NCOD) deployments were updated by N-able. Self-hosted is the exposed population.
4. There is no vendor workaround. In the interim, restrict N-central web interface access to trusted networks and VPN only.
5. Perform the hunt and audit steps on CVE-2026-18577 — check managed endpoints for cloudflared services, review Take Control session logs and the published IOC addresses, and audit administrative account changes.
6. Rotate N-central administrator credentials and API tokens, and enforce MFA on administrative accounts.
7. If you are an MSP, notify affected clients. Downstream organizations have no visibility into the RMM server and cannot detect or remediate this themselves.