[HIGH PRIORITY] N-able N-central Authentication Bypass (CVE-2026-18577)

⚠ HIGH PRIORITY — CISA KEV (Aug 2026). CVE-2026-18577 is an authentication bypass in N-able N-central RMM (incomplete fix for CVE-2026-18556). Unauthenticated attackers gain full admin control of the platform — then use Take Control to pivot to all managed Linux/Windows endpoints. Linked to active ransomware intrusions via MSP environments.

Affected N-central

• Self-hosted N-central builds 2026.3.1.7 and earlier
• MSP and internal IT teams managing Linux servers via N-central
• Internet-exposed N-central console on port 443

Check version

# N-central admin UI → About
# Or check installed build on server
grep -i version /opt/n-central/conf/*.properties 2>/dev/null

Patching Method

1. Upgrade self-hosted N-central to Hotfix 2 — build 2026.3.1.10 immediately.
2. Hotfix 1 (2026.3.1.7) is NOT sufficient — must apply 2026.3.1.10.
3. Download hotfix from N-able portal: https://me.n-able.com
4. Apply during maintenance window; verify build in admin UI after upgrade.
5. Forensic review: hunt unauthorized admin accounts and Cloudflare tunnel services on managed hosts.
6. Review Take Control session logs for anomalous remote access.
7. Rotate all N-central admin, API, and integration credentials from a clean workstation.

# IoC hunt on managed Linux endpoints
systemctl list-units | grep -i cloudflare
grep -i take.control /var/log/n-central/*.log 2>/dev/null

Until patched

• Restrict N-central console to VPN/jump-host IP allowlist only
• Disable internet exposure of N-central management URL
• Assume all managed endpoints compromised if N-central was unpatched since Aug 2026

CVSS: 8.8 High. Active ransomware campaigns confirmed.