# CVE-2026-18577: An incomplete patch for allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Source: https://junglewise.ai/threats/cve-2026-18577-n-able-n-central-authentication-bypass-and-account-takeover  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-02. Updated: 2026-08-03  
License: CC BY 4.0 with a link back

CVE-2026-18577 · Severity: critical · CVSS 8.1 · Exploited in the wild · Published 2026-08-02

N-able N-central, a remote monitoring and management platform used by IT service providers to manage client networks, contains a critical security flaw. This vulnerability allows an unauthorized attacker to bypass security checks and take over user accounts. If exploited, an attacker could gain full control over the management console, potentially impacting all client systems managed through the platform.

Technologies: [N-able N-central](https://junglewise.ai/threats/technologies/n-central). Vendors: [N-able](https://junglewise.ai/threats/vendors/n-able).

## Quick answers

**Is CVE-2026-18577 exploited in the wild?** Yes. CVE-2026-18577 is known to be exploited in the wild, first recorded on 3 August 2026. Treat it as urgent.

**How severe is CVE-2026-18577?** Critical severity, with a CVSS score of 8.1, published 2 August 2026.

**Which products and versions are affected?** N-able N-central through 2026.3.1.

**Is there a fix for CVE-2026-18577?** A patch was published on 2026-08-02: N-central 2026.3 Hotfix 1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18577 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-18577?** Check whether you run N-able N-central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

N-able N-central is vulnerable to an authentication bypass using an alternate path or channel (CWE-288). This issue stems from an incomplete patch for CVE-2026-18556. A remote, unauthenticated attacker can exploit this flaw to bypass authentication mechanisms and achieve full account takeover. The vulnerability affects N-central versions through 2026.3.1. N-able has released N-central 2026.3 Hotfix 1 (version 2026.3.1.7) to address this issue. The vulnerability has reportedly been exploited in the wild.

## Affected products

- N-able N-central through 2026.3.1

## Timeline

- 2026-08-02: disclosed: Initial publication by N-able
- 2026-08-02: patched: N-central 2026.3 Hotfix 1 released
- 2026-08-03: advisory: NVD publication date
- 2026-08-03: exploited: Reported as exploited in the wild in advisory metadata

## Related threats

- [N-able N-central missing authentication in critical function](https://junglewise.ai/threats/cve-2026-91000-missing-authentication-for-critical-function-vulnerability-in-n)
- [N-able N-central unsigned code download in upgrade package](https://junglewise.ai/threats/cve-2026-125958-download-of-code-without-integrity-check-vulnerability-in-n-able)
- [N-able N-central XXE vulnerability in XML parsing](https://junglewise.ai/threats/cve-2026-125883-improper-restriction-of-xml-external-entity-reference)
- [N-able N-central path traversal in file repository upload](https://junglewise.ai/threats/cve-2026-125882-relative-path-traversal-vulnerability-in-n-able-n-central-allows)
- [N-able N-central server-side request forgery in schema validation](https://junglewise.ai/threats/cve-2026-125881-server-side-request-forgery-ssrf-vulnerability-in-n-able-n)