# CVE-2026-18556: N-able N-central authentication bypass via alternate path

Source: https://junglewise.ai/threats/cve-2026-18556-n-able-n-central-authentication-bypass-via-alternate-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-04  
License: CC BY 4.0 with a link back

CVE-2026-18556 · Severity: critical · CVSS 7.4 · Exploited in the wild · Published 2026-08-01

N-able N-central, a remote monitoring and management (RMM) platform used by IT service providers to manage client networks, contains a critical security flaw. This vulnerability allows an unauthorized person to bypass standard login procedures and gain access to the system. If exploited, an attacker could potentially take control of the management platform, leading to unauthorized access to sensitive client data and the ability to interfere with managed IT operations.

Technologies: [N-able N-central](https://junglewise.ai/threats/technologies/n-central). Vendors: [N-able](https://junglewise.ai/threats/vendors/n-able).

## Quick answers

**Is CVE-2026-18556 exploited in the wild?** Yes. CVE-2026-18556 is known to be exploited in the wild, first recorded on 4 August 2026. Treat it as urgent.

**How severe is CVE-2026-18556?** Critical severity, with a CVSS score of 7.4, published 1 August 2026.

**Which products and versions are affected?** N-able N-central through 2026.1.

**Is there a fix for CVE-2026-18556?** A patch was published on 2026-08-02: N-able security update blog post published Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18556 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-18556?** Check whether you run N-able N-central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability (CWE-288) exists in N-able N-central through version 2026.1. The flaw involves the use of an alternate path or channel that allows an attacker to circumvent established authentication mechanisms. The attack vector is network-based and requires no prior privileges or user interaction, though it is rated with high attack complexity. Successful exploitation allows an attacker to bypass authentication entirely, potentially leading to full compromise of the N-central instance. N-able has released security updates to address this issue.

## Affected products

- N-able N-central through 2026.1

## Timeline

- 2026-08-01: disclosed: Initial N-able disclosure and NVD publication
- 2026-08-02: patched: N-able security update blog post published
- 2026-08-04: advisory: NVD assessment and CISA-ADP enrichment updated

## Related threats

- [N-able N-central missing authentication in critical function](https://junglewise.ai/threats/cve-2026-91000-missing-authentication-for-critical-function-vulnerability-in-n)
- [N-able N-central unsigned code download in upgrade package](https://junglewise.ai/threats/cve-2026-125958-download-of-code-without-integrity-check-vulnerability-in-n-able)
- [N-able N-central XXE vulnerability in XML parsing](https://junglewise.ai/threats/cve-2026-125883-improper-restriction-of-xml-external-entity-reference)
- [N-able N-central path traversal in file repository upload](https://junglewise.ai/threats/cve-2026-125882-relative-path-traversal-vulnerability-in-n-able-n-central-allows)
- [N-able N-central server-side request forgery in schema validation](https://junglewise.ai/threats/cve-2026-125881-server-side-request-forgery-ssrf-vulnerability-in-n-able-n)