NCSC-2026-0275 [1.00] [M/H] Vulnerabilities patched in N-able N-central
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
N-able has patched vulnerabilities in N-able N-central up to version 2026.3.1. The vulnerabilities concern authentication bypass in N-able N-central. In versions up to 2026.1, an attacker can bypass authentication controls by exploiting an alternative route within the application. In versions up to 2026.3.1, an incomplete patch for the vulnerability identified as CVE-2026-18556 has been introduced that enables authentication bypass and account takeover. This issue has been assigned the identifier CVE-2026-18577. As a result, an attacker can gain unauthorized access to user accounts and control the system. All implementations using the mentioned versions are vulnerable. N-able reports that exploitation of the vulnerability has been discovered and has informed users accordingly.
CSIRTS triage
- What
- An incomplete patch for CVE-2026-18556 reintroduced authentication bypass and account takeover vulnerability.
- Who is affected
- All N-able N-central deployments running versions up to 2026.3.1 are affected.
- Urgency
- High; exploitation has been discovered in the field.
- Action
- Upgrade to a version patching CVE-2026-18577 beyond 2026.3.1.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch N-central
Get an email when a new N-central advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0275
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-18556Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 40% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2026-18577Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 90% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-18556 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18577 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedNCSC-2026-0275 [1.01] [M/H] Vulnerabilities patched in N-able N-centralncsc-nl
- unknownexploitedN-able security advisory (AV26-769) - Update 1cccs
- highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerabilitycisa-kev
- highexploitedCISA Adds One Known Exploited Vulnerability to Catalogcisa
- medium[NEW] [medium] N-able N-Central: Multiple vulnerabilities enable bypassing security measurescert-bund
- criticalexploitedCVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerabilitycisa-kev
- highexploitedCVE-2026-18577: An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover i…nvd
- highexploitedCVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central all…nvd
Recent advisories for N-able N-central
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownexploitedNCSC-2026-0275 [1.01] [M/H] Vulnerabilities patched in N-able N-centralncsc-nl · 2026-08-07
- criticalexploitedCVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerabilitycisa-kev · 2026-08-04
- medium[NEW] [medium] N-able N-Central: Multiple vulnerabilities enable bypassing security measurescert-bund · 2026-08-03
- criticalexploitedCVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerabilitycisa-kev · 2026-08-03
- highexploitedCVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central all…nvd · 2026-08-01
- criticalexploitedCVE-2025-8876: N-able N-Central Command Injection Vulnerabilitycisa-kev · 2025-08-13
More from NCSC-NL Advisories
- unknownNCSC-2026-0279 [1.00] [M/H] Vulnerabilities patched in Cisco IOS XE Software2026-08-07
- unknownNCSC-2026-0275 [1.01] [M/H] Vulnerabilities patched in N-able N-central2026-08-07
- unknownNCSC-2026-0278 [1.00] [M/H] Vulnerabilities patched in Adobe Campaign Classic2026-08-06
- unknownNCSC-2026-0277 [1.00] [M/H] Vulnerabilities patched in Cisco Catalyst SD-WAN2026-08-06
- unknownNCSC-2026-0276 [1.00] [M/H] Vulnerabilities patched in Veeam Service Provider Console2026-08-05