cve-2026-18577

{
  "cvss": 8.2,
  "datePublished": "2026-08-02T23:16:26.210",
  "dateUpdated": "2026-10-23T22:10:00.160",
  "description": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1",
  "id": "CVE-2026-18577",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "N-central",
            "vendor": "N-able",
            "versions": [
              {
                "lessThanOrEqual": "2026.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "2026.3.1.7",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"
      }
    ],
    "cisaActionDue": "2026-08-06",
    "cisaExploitAdd": "2026-08-03",
    "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "cisaVulnerabilityName": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability",
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "6CEC2750-AFFB-40A4-97E0-88BDAC106F5E",
                "versionEndExcluding": "2026.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:n-able:n-central:2026.3:-:*:*:*:*:*:*",
                "matchCriteriaId": "EB21160B-DDC4-4F70-A703-E313DED8CAF2",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1"
      },
      {
        "lang": "es",
        "value": "Un parche incompleto para CVE-2026-18556 permite la omisión de autenticación y la toma de control de cuentas en las versiones de N-central hasta la 2026.3.1."
      }
    ],
    "id": "CVE-2026-18577",
    "lastModified": "2026-10-23T22:10:00.160",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.9,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "ATTACKED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-18577",
            "options": [
              {
                "exploitation": "active"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-04T03:56:18.454615Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-02T23:16:26.210",
    "references": [
      {
        "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
        "tags": [
          "Patch",
          "Release Notes"
        ],
        "url": "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm"
      },
      {
        "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
        "tags": [
          "Release Notes"
        ],
        "url": "https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/"
      },
      {
        "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
        "tags": [
          "VDB Entry"
        ],
        "url": "https://www.cve.org/CVERecord?id=CVE-2026-18556"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "US Government Resource"
        ],
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18577"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.n-able.com/blog/n-central-security-update-august-2-2026"
      }
    ],
    "sourceIdentifier": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-288"
          }
        ],
        "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
        "type": "Secondary"
      }
    ]
  },
  "severity": "HIGH",
  "source": "nvd",
  "title": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions th..."
}