Our takeN-able's fix for CVE-2026-18556 was incomplete — CISA now lists the bypass around it (CVE-2026-18577) as actively exploited, giving attackers full admin access to N-central. If you run N-central (mostly MSPs), patch per vendor instructions now.Cyber Resilience desk
Sources (3)
- cisa_kev · cisa_kev
- register_sec · register_sec
- cisa_advisories · cisa_advisories
What this means for you — Security leader:CISA added CVE-2026-18577 to KEV: this is an incomplete patch for the prior N-central auth bypass (CVE-2026-18556) now under confirmed active exploitation. Patch N-central to 2026.3.1.7 or later immediately and hunt for prior compromise.
What this means for you — Lean IT orgs:If you run N-able N-central yourself, this incomplete patch for an authentication bypass is under confirmed active exploitation. Update to 2026.3.1.7 or later right away and check for signs of unauthorized admin access.
What this means for you — MSP:N-able N-central CVE-2026-18577 (incomplete fix for CVE-2026-18556) is under confirmed active exploitation and gives full admin access. Patch every instance to 2026.3.1.7+ immediately, hunt for compromise, and tell every client you manage this for them.
What this means for you — Researcher:CISA added CVE-2026-18577 to KEV. It is the incomplete patch for N-central auth bypass CVE-2026-18556 and is under confirmed active exploitation allowing account takeover.