← gociux.comall exploited CVEs

Exploited vulnerability · CISA KEV

Is CVE-2026-18577 exploited? Yes: in CISA KEV since 3 Aug 2026

Gociux · N-able N-central · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2026-18577, N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 3 Aug 2026, 1 days after it was published. It affects N-able N-central. If you run it, CISA's required action is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

exploitedYesCISA KEV · 3 Aug 2026
ransomwareNot knownno confirmed use
EPSStop 5%very likely to be exploited
severity8.2CVSS 4.0 · high
US federal due6 Aug 2026BOD 22-01 deadline

What it is

N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.

VendorN-able (5 exploited CVEs in KEV)
ProductN-central
VulnerabilityN-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
WeaknessCWE-288
Published2 Aug 2026
Added to KEV3 Aug 2026
Reported by (CNA)N-able

What to do

  1. Check whether you run it. Look for N-central in your asset inventory, including appliances and cloud images. Stack check lists every exploited N-able CVE at once.
  2. Apply the fix. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
  3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 2 Aug 2026.
  4. Get told next time. Email alerts when CISA adds a CVE for N-able.

Other exploited CVEs in N-central

References

Questions

Is CVE-2026-18577 being exploited?

Yes. CISA added CVE-2026-18577 to the Known Exploited Vulnerabilities catalog on 3 Aug 2026, which means there is reliable evidence of exploitation in the wild.

Is CVE-2026-18577 used in ransomware attacks?

CISA does not list known ransomware use for it. That can change, and exploitation alone is reason to fix it first.

How do I fix CVE-2026-18577?

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Check N-able's advisory for the fixed versions, and if you can't patch quickly, restrict access to the affected N-central and watch it for signs of compromise.

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in August 2026 · N-able scorecard · act-now radar.

Running N-able in a regulated environment?

We check exposure across your estate, patch or mitigate with your team, and set up detection for what attackers do after exploiting it.

Get in touch →