[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH0LFaor9T64YlWqOkOyT4uoLtrnb4UjY-AZdJsyP5bs":3,"$fMzNhSZ7WxMOucAZm0g-TQTs8rSGRzOByRZHpUVJSpJc":103},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":100,"created_at":101,"updated_at":102,"published_at":65},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-Able N-Central RCE with 3-day federal deadline","CVE-2026-18556 is an unauthenticated authentication bypass in N-central through 2026.1, actively exploited in the wild, with a 3-day federal remediation deadline.","CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.",[10,11,12,13,14],"CVE-2026-18556","N-Able N-Central","CISA KEV","RCE","authentication bypass","# CISA KEV adds N-Able N-Central RCE with 3-day federal deadline\n\n*CVE-2026-18556 is an unauthenticated authentication bypass in N-central through 2026.1, actively exploited in the wild, with a 3-day federal remediation deadline.*\n\n**Tags:** `CVE-2026-18556` `N-Able N-Central` `CISA KEV` `RCE` `authentication bypass`\n\n> CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-9198 | 9.8 | 60.6% | ✅ listed | — | 89.72 (Critical) |\n| CVE-2026-34486 | 7.5 | 98.6% | ✅ listed | available | 77.75 (High) |\n| CVE-2026-18556 | — | 40.2% | ✅ listed | — | 72.91 (High) |\n| CVE-2026-18577 | — | 54.1% | ✅ listed | — | 73.08 (High) |\n| CVE-2026-86206 | — | 0.7% | — | — | 1.27 (Info) |\n\n## CISA KEV adds N-Able N-Central RCE with 3-day federal deadline\n\nCISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog on August 4, 2026, with a federal remediation deadline of August 7, 2026. The vulnerability is an authentication bypass in N-able N-central that allows unauthenticated remote attackers to gain administrative access on both on-prem and cloud-hosted installations. It affects all versions through 2026.1 and is fixed in 2026.3.1.7.\n\nThe flaw carries a CVSS 7.4 score (NVD 3.1) and an EPSS probability of 40.2% at the 99th percentile, indicating high real-world exploit likelihood. Precursor Intelligence rates it at 72.91 (High) on its PRS risk scale. No public PoC has been released, but CISA confirmed active exploitation in the wild, which triggered the KEV listing.\n\n## How the auth bypass works\n\nThe vulnerability works by letting an unauthenticated remote attacker bypass the standard authentication check through an alternate path or channel. Once the bypass succeeds, the attacker lands with a full administrative account on the N-central server — what the vendor calls “God-mode” — giving them remote access sessions and full control over the RMM instance.\n\nExploitation doesn’t stop at the initial foothold. Attackers establish persistence on managed devices by dropping an `svchost.exe` binary into the User Documents folder and registering a malicious Windows service under the name `Cloudflared`. This keeps them on the endpoint even after the initial session closes.\n\nThe fix in version 2026.2 (released April 28, 2026) was not sufficient. N-able confirmed on July 31 that a related attack path remained reachable through a different vector, and shipped CVE-2026-18577 on August 2, 2026. That second CVE is an incomplete patch bypass for 18556, covering versions through 2026.3.1.\n\n## The four hotfixes and why they shipped fast\n\nN-able shipped four hotfixes in rapid succession to close the authentication bypass chain that CISA just added to KEV. The first hotfix (HF1) addresses the initial auth bypass — CVE-2026-18556 and its companion CVE-2026-18577 — which let unauthenticated attackers grab admin access through an alternate path. HF2 added extra protection after continued monitoring surfaced a related attack path and evolving attacker techniques. HF3 fixed two separate access-control flaws, including CVE-2026-86206 for the internal API access control filter, plus one more. HF4 is the final hardening pass. All four landed in quick succession, which is why the vendor could close the full chain before the August 4 KEV listing forced the federal deadline.\n\n## Who was hit and what they got\n\nN-able confirmed active exploitation in the wild for both CVE-2026-18556 and CVE-2026-18577, adding them to the CISA Known Exploited Vulnerabilities catalog on August 4, 2026. The vendor stated it observed a significant spike in licensing issues from N-central customers on July 31, 2026, which triggered the discovery of the second CVE.\n\nExploitation establishes malicious persistence on managed devices. Attackers drop an `svchost.exe` binary into the User Documents folder and register a Windows service under the name `Cloudflared` to maintain access after the initial session closes.\n\n## Key points\n\n- CVE-2026-18556 is an unauthenticated authentication bypass in N-able N-central through 2026.1, rated CVSS 7.4 (NVD 3.1) with EPSS 40.2% (99th percentile) and PRS risk 72.91 (High).\n- CISA added the CVE to its Known Exploited Vulnerabilities catalog with a 3-day federal remediation deadline, confirming active in-the-wild exploitation.\n- A second CVE, CVE-2026-18577, is an incomplete patch for CVE-2026-18556 that also allows authentication bypass and account takeover in N-central through 2026.3.1.\n- Successful exploitation grants remote unauthenticated attackers administrative access, enabling remote access sessions and persistence via svchost.exe and a Cloudflared service on managed devices.\n- N-central 2026.3.1 HF4 is the recommended fix; all on-prem and cloud-hosted installations are vulnerable.\n\n## Further reading & sources\n\n- [IBM Langflow, Apache Tomcat, N-able RCE and auth bypass…](https:\u002F\u002Fdefend.network\u002Fbriefings\u002Fibm-langflow-tomcat-n-central-critical-cisa-kev-2026-08-06.html) — defend.network Daily Briefings\n- [N-able N-central vulnerabilities: How to find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fn-able-n-central)\n- [N-able N-central HF4 Patches Critical Pre-Auth RCE](https:\u002F\u002Fsocradar.io\u002Fblog\u002Fn-able-n-central-hf4-critical-rce-auth-flaws)\n- [N-able N-central vulnerability grants unauthenticated users “God-mode”](https:\u002F\u002Fwww.threatlocker.com\u002Fblog\u002Fn-able-n-central-vulnerability-grants-unauthenticated-users-god-mode)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66",{"cves":18,"malware":55,"targets":60,"timeline":66,"industries":86,"technologies":91},[19,28,34,40,48],{"id":10,"kev":20,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},true,false,"\u002Fvulnerabilities\u002FCVE-2026-18556",7.4,0.0788,"High",74.41,"3.1",{"id":29,"kev":20,"poc":21,"url":30,"cvss":31,"epss":32,"risk_band":25,"risk_score":33,"cvss_version":27},"CVE-2026-18577","\u002Fvulnerabilities\u002FCVE-2026-18577",8.1,0.1462,74.08,{"id":35,"kev":20,"poc":20,"url":36,"cvss":37,"epss":38,"risk_band":25,"risk_score":39,"cvss_version":27},"CVE-2026-34486","\u002Fvulnerabilities\u002FCVE-2026-34486",7.5,0.0656,76.25,{"id":41,"kev":21,"poc":21,"url":42,"cvss":43,"epss":44,"risk_band":45,"risk_score":46,"cvss_version":47},"CVE-2026-86206","\u002Fvulnerabilities\u002FCVE-2026-86206",6.9,0.0112,"Low",24.7,"4.0",{"id":49,"kev":20,"poc":21,"url":50,"cvss":51,"epss":52,"risk_band":53,"risk_score":54,"cvss_version":27},"CVE-2026-9198","\u002Fvulnerabilities\u002FCVE-2026-9198",9.8,0.2866,"Critical",89.63,[56,58],{"name":57},"Cloudflared",{"name":59},"svchost.exe",[61],{"name":62,"sector":63,"status":64,"geography":65},"N-able","IT","confirmed",null,[67,71,75,79,82],{"date":68,"event":69,"description":70},"2026-04-28","Release","Version 2026.2 released as fix for CVE-2026-18556",{"date":72,"event":73,"description":74},"2026-08-01","Advisory","N-able releases advisory for CVE-2026-18556",{"date":76,"event":77,"description":78},"2026-08-03","Kev addition","CVE-2026-18577 added to CISA KEV catalog",{"date":80,"event":77,"description":81},"2026-08-04","CVE-2026-18556 added to CISA KEV catalog",{"date":83,"event":84,"description":85},"2026-08-06","CISA KEV addition","CISA added four critical vulnerabilities to KEV",[87],{"url":88,"name":89,"slug":90},"\u002Findustries\u002Ftechnology","Technology","technology",[92,94,97],{"vendor":62,"product":93},"N-central",{"vendor":95,"product":96},"Apache","Tomcat",{"vendor":98,"product":99},"IBM","Langflow","vulnerability_disclosure","2026-09-21T12:03:34.769619+00:00","2026-10-16T12:28:18.763278+00:00",{"articles":104},[105,116,128,140],{"slug":106,"title":107,"summary":108,"tags":109,"hero_image_url":113,"story_type":114,"created_at":115},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found 274 internet-facing Zimbra Collaboration Suite servers compromised in-the-wild via CVE-2026-73570, an unauthenticated OS command injection in the zimbra-snmp package that lets attackers execute arbitrary commands as the zimbra user via crafted SMTP requests.",[110,111,13,12,112],"Zimbra","CVE-2026-73570","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","exploitation","2026-09-24T07:12:41.74195+00:00",{"slug":117,"title":118,"summary":119,"tags":120,"hero_image_url":126,"story_type":100,"created_at":127},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004: Unauthenticated Attackers Execute Shell Commands via diffpatch","Gitea disclosed CVE-2026-60004, a critical remote code execution vulnerability in the diffpatch feature that allows unauthenticated remote attackers to write malicious Git hooks and execute arbitrary shell commands as the Gitea process user on default installations with open self-registration enabled.",[121,122,13,123,124,125],"Gitea","CVE-2026-60004","diffpatch","Git hooks","CVSS 9.8","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81","2026-09-12T12:07:21.883073+00:00",{"slug":129,"title":130,"summary":131,"tags":132,"hero_image_url":138,"story_type":100,"created_at":139},"jetbrains-teamcity-rce-cve-2026-63077-exposed-via-runzero-asset-discovery","JetBrains TeamCity RCE (CVE-2026-63077) Exposed via RunZero Asset Discovery","JetBrains TeamCity On-Premises before 2023.05.4 has an authentication bypass (CWE-288) that lets an unauthenticated remote attacker execute arbitrary code on the server, enabling supply-chain compromise of CI\u002FCD builds.",[133,134,135,13,136,137],"JetBrains","TeamCity","CVE-2023-42793","CI\u002FCD","RunZero","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fjetbrains-teamcity-rce-cve-2026-63077-exposed-via-runzero-asset-discovery.png?v=e72ab95e44","2026-09-12T07:13:03.260727+00:00",{"slug":141,"title":142,"summary":143,"tags":144,"hero_image_url":149,"story_type":100,"created_at":150},"cisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild","Cisco confirms FMC auth-bypass CVE-2026-20079 exploited in the wild","Cisco updated its advisory for CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center, confirming active exploitation after PSIRT became aware in August 2026; CISA added the CVE to its KEV catalog with a September 12, 2026 due date for FCEB agencies.",[145,146,147,12,148],"Cisco","CVE-2026-20079","FMC","auth-bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild.png?v=e25c4c61c3","2026-09-12T07:10:09.180903+00:00"]