CVE-2026-18556: N-able N-central

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

Yes, if you run N-able N-central. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2026-08-04, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2026-08-07; treat that as the outer limit, not the target.
EPSS 7.9%, percentile 95: FIRST’s model estimates a 7.9% chance of exploitation activity in the next 30 days, higher than 95% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
Editorial verdict: Act now. N-able N-central: Exploited Auth Bypass and Pre-Auth RCE — Any self-hosted N-central server below 2026.3.1.14 should be treated as exposed and patched today, and any server that was patched late needs a compromise review, because one stolen RMM console reaches every managed endpoint.

What it is

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

CISA’s summary

N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.

Weakness type: CWE-288.

Product: N-able N-central · Assigned by: N-able · Published: 2026-08-01

Affected and fixed versions

Vendor	Product	Affected versions (per CVE record)
N-able	N-central	<= 2026.1

Severity scores

Scored by	CVSS	Score	Vector
N-able	4.0	8.2 High	`CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`

Attack vector: network (remotely reachable)
Attack complexity: high (needs special conditions)
Attack requirements: none
Privileges required: none (no login)
User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

CISA KEV: added 2026-08-04; federal due date 2026-08-07. Known ransomware use: Unknown.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA SSVC assessment: exploitation active, automatable yes, technical impact total.
FIRST EPSS (model of 2026-10-21): 7.88% probability of exploitation activity in the next 30 days; percentile 95.

Timeline

2026-08-01 — CVE record published by N-able
2026-08-01 — erroneo.us brief: N-able N-central: Exploited Auth Bypass and Pre-Auth RCE
2026-08-04 — Added to CISA’s Known Exploited Vulnerabilities catalog
2026-08-05 — CVE record last updated
2026-08-07 — CISA remediation deadline for US federal agencies

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.