Skip to content
VulniPulse
Sign in
Highest advisory severityHigh Exploited CISA KEV 1 vendor · 2 advisories

CVE-2026-18556

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability. In CISA KEV since 2026-08-04.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-18556 at a glance

CISA KEV
Listed on · federal remediation due
Highest advisory severity
High
CVSS base score
8.2 (N-able)
Vendor advisories
2 from N-able
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-18556; bulletin-wide values are not repeated here.

Is CVE-2026-18556 exploited?

Yes. CISA lists CVE-2026-18556 in its Known Exploited Vulnerabilities catalog (added ), which means CISA has evidence of exploitation in the wild.

How do I fix CVE-2026-18556?

  • N-able's August 10, 2026 notice directs on-premises customers to apply N-central 2026.3 Hotfix 2 (2026.3.1.10). (N-able)

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor advisory comparison

N-able

2 advisories
  • Advisory severityHigh8.2

    High [CVE-2026-18556 +1] Incomplete patch leads to administrative account takeover

    CVE-2026-18577Source published Source updated

    This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

    Affected products in this advisory
    • N-central
    Source-reported affected versions
    • N-central through 2026.3
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • N-able's August 10, 2026 notice directs on-premises customers to apply N-central 2026.3 Hotfix 2 (2026.3.1.10).
    Full advisory and evidenceOpen source bulletin
  • Advisory severityHigh8.2

    High [CVE-2026-18556] Unauthenticated administrative account takeover

    CVE-2026-18556Source published Source updated

    Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

    Affected products in this advisory
    • N-central
    Source-reported affected versions
    • N-central through 2026.1
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • N-able's August 10, 2026 notice directs on-premises customers to apply N-central 2026.3 Hotfix 2 (2026.3.1.10).
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future N-able CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features