Authentication bypass in N-able N-central (CVE-2026-18556) — breaking the remote management platform reaches every managed endpoint
The IT remote management platform N-able N-central contains a vulnerability allowing authentication to be bypassed through an alternate path or channel. CISA added it to KEV on August 4, 2026 with a due date of August 7. Because the product manages many endpoints, a compromise does not stop at one machine.
Key facts
- CVE IDCVE-2026-18556
- Affected (vendor / product)N-able N-central
- CWECWE-288
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-08-07 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Affected: N-able N-central, an IT remote management (RMM) platform. CWE-288 (authentication bypass using an alternate path or channel).
- Functionality can be reached without authentication through a path separate from the normal login flow — a back door standing open.
- RMM platforms can distribute software and run commands across many endpoints, so a compromise spreads at once.
- CISA references also include a hotfix notice covering a separate CVE in the same product (CVE-2026-18577).
- Added to KEV 2026-08-04 with a due date of 2026-08-07 — three days.
- CWE-288 leaves a route separate from the legitimate login, which hardening authentication cannot close.
1Authentication bypass through an alternate path (CWE-288)
CWE-288 covers defects in which a path separate from the normal login flow remains available and reaching functionality through it skips authentication. Rather than breaking the login screen, a back door is standing open. Typically such a path was provided by design for internal use or backward compatibility and was left reachable from outside.
2How far a compromised RMM reaches
N-central is a platform for managing and maintaining IT equipment remotely (RMM). Products of this kind hold the privilege to distribute software and run commands across many managed endpoints. If authentication on the management platform is bypassed, that reach extends to the managed fleet at once. It is the same shape as the ScreenConnect case this site covers: RMM is a lever that amplifies an intrusion.
3Several CVEs appearing at once
CISA's references include a hotfix notice covering mitigation for a separate vulnerability in the same product (CVE-2026-18577). When several vulnerabilities in one product enter KEV close together, updating to the fixed release the vendor announces is more reliable than handling each in isolation. The due date is set three days after the addition.
4Not the front lock, but another route
CWE-288 denotes a flaw where a route separate from the legitimate login remains open, and taking it reaches the functions without passing authentication. Preventing that differs from hardening the login.
The typical origin is a route provided by design for internal use or backward compatibility, left reachable from outside. N-central is a platform for managing and maintaining IT equipment remotely, holding the privilege to distribute software and run commands across many managed endpoints.
In assessing possible compromise, the authentication logs of the management platform and the history of distribution and execution are both worth checking.
Why it matters
A remote management platform may hold privileges over customer environments under contract, not only over an organization's own endpoints. Because the blast radius can cross organizational boundaries, updating the management platform belongs to business continuity rather than to routine IT operations. Preserving authentication logs and distribution and execution history also matters for accountability afterward.
FAQ
What is authentication bypass through an alternate path?
Why is compromising an RMM so serious?
What if several CVEs affect the same product?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).