NCSC-2026-0275 [1.01] [M/H] Vulnerabilities patched in N-able N-central
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
N-able has patched vulnerabilities in N-able N-central up to version 2026.3.1. The vulnerabilities concern authentication bypass in N-able N-central. In versions up to 2026.1, an attacker can circumvent authentication controls by exploiting an alternative route within the application. In versions up to 2026.3.1, an incomplete patch for the vulnerability identified as CVE-2026-18556 has been introduced that enables authentication bypass and account takeover. This issue has been assigned the identifier CVE-2026-18577. This allows an attacker to gain unauthorized access to user accounts and control the system. All implementations using the mentioned versions are vulnerable. N-able reports that exploitation of the vulnerability has been discovered and users have been informed accordingly.
CSIRTS triage
- What
- Authentication controls can be circumvented through an alternative application route, and an incomplete patch introduced further authentication bypass and account takeover vulnerabilities.
- Who is affected
- All implementations of N-able N-central using versions up to 2026.3.1 are vulnerable.
- Urgency
- Immediate patching required; exploitation has been actively discovered in the wild and the vulnerability enables full account takeover.
- Action
- Upgrade N-able N-central to a version later than 2026.3.1 where the complete patch for CVE-2026-18556 and CVE-2026-18577 has been applied.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch N-central
Get an email when a new N-central advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0275
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-18556Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 40% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2026-18577Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 90% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-18556 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18577 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedN-able security advisory (AV26-769) - Update 1cccs
- highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerabilitycisa-kev
- highexploitedCISA Adds One Known Exploited Vulnerability to Catalogcisa
- medium[NEW] [medium] N-able N-Central: Multiple vulnerabilities enable bypassing security measurescert-bund
- unknownexploitedNCSC-2026-0275 [1.00] [M/H] Vulnerabilities patched in N-able N-centralncsc-nl
- criticalexploitedCVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerabilitycisa-kev
- highexploitedCVE-2026-18577: An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover i…nvd
- highexploitedCVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central all…nvd
Recent advisories for N-able N-central
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalexploitedCVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerabilitycisa-kev · 2026-08-04
- medium[NEW] [medium] N-able N-Central: Multiple vulnerabilities enable bypassing security measurescert-bund · 2026-08-03
- unknownexploitedNCSC-2026-0275 [1.00] [M/H] Vulnerabilities patched in N-able N-centralncsc-nl · 2026-08-03
- criticalexploitedCVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerabilitycisa-kev · 2026-08-03
- highexploitedCVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central all…nvd · 2026-08-01
- criticalexploitedCVE-2025-8876: N-able N-Central Command Injection Vulnerabilitycisa-kev · 2025-08-13
More from NCSC-NL Advisories
- unknownNCSC-2026-0278 [1.00] [M/H] Vulnerabilities patched in Adobe Campaign Classic2026-08-06
- unknownNCSC-2026-0277 [1.00] [M/H] Vulnerabilities patched in Cisco Catalyst SD-WAN2026-08-06
- unknownNCSC-2026-0276 [1.00] [M/H] Vulnerabilities patched in Veeam Service Provider Console2026-08-05
- unknownNCSC-2026-0268 [1.01] [M/H] Vulnerability patched in SQLite by SQLite Consortium (withdrawn)2026-08-03
- unknownNCSC-2026-0275 [1.00] [M/H] Vulnerabilities patched in N-able N-central2026-08-03