CVE-2026-18556 · Moderate · CISA KEV

N-able N-central Authentication Bypass (CVE-2026-18556) Exploited In The Wild

Threat Engine Auto-Feed · data current as of 2026-08-05

CVE-2026-18556 is an authentication bypass vulnerability in N-able N-central that has been exploited in the wild and added to CISA's KEV catalog. While specific details on exposure and authentication are unknown, its active exploitation indicates a significant risk. Organizations using N-able N-central should prioritize detection and containment.

  • CVSS:
  • EPSS percentile: 0.39605
  • Exploitation pressure: 49/100 (Moderate)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 40th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves an authentication bypass, meaning an attacker can circumvent the normal login process to gain unauthorized access. This is achieved by exploiting an 'alternate path or channel' within the software, allowing them to bypass security checks designed to verify user identity.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using N-able N-central for IT management
  • Financial services organizations (due to confirmed adversary targeting)
  • Technology sector organizations (due to confirmed adversary targeting)

Misconfigurations that escalate it

  • Lack of robust network segmentation for critical IT management infrastructure
  • Insufficient logging and monitoring of authentication attempts on N-able N-central instances

High-impact scenarios

  • Unauthorized access to IT management infrastructure, potentially leading to broader network compromise
  • Disruption of IT operations and services managed by N-able N-central
  • Data exfiltration or deployment of ransomware by financially motivated threat actors

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor N-able N-central logs for unusual authentication attempts or access from unexpected sources.
  • Implement network intrusion detection systems (NIDS) to identify suspicious traffic patterns to/from N-able N-central instances.

Contain

  • Isolate N-able N-central instances from the broader network if signs of compromise are detected.
  • Review and restrict network access to N-able N-central to only necessary administrative interfaces and IP ranges.

Patch

  • Apply vendor-provided patches for N-able N-central as soon as they become available to address CVE-2026-18556.

Frontier verdict — Moderate

Prioritize immediate attention due to confirmed in-the-wild exploitation and inclusion in CISA KEV, despite unknown CVSS.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.