Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-9198 | 9.8 | 60.6% | ✅ listed | — | 89.72 (Critical) |
| CVE-2026-34486 | 7.5 | 98.6% | ✅ listed | available | 77.75 (High) |
| CVE-2026-18556 | — | 40.2% | ✅ listed | — | 72.91 (High) |
| CVE-2026-18577 | — | 54.1% | ✅ listed | — | 73.08 (High) |
| CVE-2026-86206 | — | 0.7% | — | — | 1.27 (Info) |
CISA KEV adds N-Able N-Central RCE with 3-day federal deadline
CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog on August 4, 2026, with a federal remediation deadline of August 7, 2026. The vulnerability is an authentication bypass in N-able N-central that allows unauthenticated remote attackers to gain administrative access on both on-prem and cloud-hosted installations. It affects all versions through 2026.1 and is fixed in 2026.3.1.7.
The flaw carries a CVSS 7.4 score (NVD 3.1) and an EPSS probability of 40.2% at the 99th percentile, indicating high real-world exploit likelihood. Precursor Intelligence rates it at 72.91 (High) on its PRS risk scale. No public PoC has been released, but CISA confirmed active exploitation in the wild, which triggered the KEV listing.
How the auth bypass works
The vulnerability works by letting an unauthenticated remote attacker bypass the standard authentication check through an alternate path or channel. Once the bypass succeeds, the attacker lands with a full administrative account on the N-central server — what the vendor calls “God-mode” — giving them remote access sessions and full control over the RMM instance.
Exploitation doesn’t stop at the initial foothold. Attackers establish persistence on managed devices by dropping an svchost.exe binary into the User Documents folder and registering a malicious Windows service under the name Cloudflared. This keeps them on the endpoint even after the initial session closes.
The fix in version 2026.2 (released April 28, 2026) was not sufficient. N-able confirmed on July 31 that a related attack path remained reachable through a different vector, and shipped CVE-2026-18577 on August 2, 2026. That second CVE is an incomplete patch bypass for 18556, covering versions through 2026.3.1.
The four hotfixes and why they shipped fast
N-able shipped four hotfixes in rapid succession to close the authentication bypass chain that CISA just added to KEV. The first hotfix (HF1) addresses the initial auth bypass — CVE-2026-18556 and its companion CVE-2026-18577 — which let unauthenticated attackers grab admin access through an alternate path. HF2 added extra protection after continued monitoring surfaced a related attack path and evolving attacker techniques. HF3 fixed two separate access-control flaws, including CVE-2026-86206 for the internal API access control filter, plus one more. HF4 is the final hardening pass. All four landed in quick succession, which is why the vendor could close the full chain before the August 4 KEV listing forced the federal deadline.
Who was hit and what they got
N-able confirmed active exploitation in the wild for both CVE-2026-18556 and CVE-2026-18577, adding them to the CISA Known Exploited Vulnerabilities catalog on August 4, 2026. The vendor stated it observed a significant spike in licensing issues from N-central customers on July 31, 2026, which triggered the discovery of the second CVE.
Exploitation establishes malicious persistence on managed devices. Attackers drop an svchost.exe binary into the User Documents folder and register a Windows service under the name Cloudflared to maintain access after the initial session closes.
Key points
- CVE-2026-18556 is an unauthenticated authentication bypass in N-able N-central through 2026.1, rated CVSS 7.4 (NVD 3.1) with EPSS 40.2% (99th percentile) and PRS risk 72.91 (High).
- CISA added the CVE to its Known Exploited Vulnerabilities catalog with a 3-day federal remediation deadline, confirming active in-the-wild exploitation.
- A second CVE, CVE-2026-18577, is an incomplete patch for CVE-2026-18556 that also allows authentication bypass and account takeover in N-central through 2026.3.1.
- Successful exploitation grants remote unauthenticated attackers administrative access, enabling remote access sessions and persistence via svchost.exe and a Cloudflared service on managed devices.
- N-central 2026.3.1 HF4 is the recommended fix; all on-prem and cloud-hosted installations are vulnerable.