CVE-2026-18556KEV · OVERDUECWE-288
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
High · published August 2, 2026
Patch now
Confirmed exploited, and the score agrees
CVSS calls it high at 7.4. It is confirmed in active exploitation. It sits in the 94.7th percentile for exploit probability.
What it is
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
This issue affects N-central: through 2026.1.
The record
Technical detail
- CVSS v3.1
- 7.4 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.07882 · 94.7th percentile
- Weakness
- CWE-288 · Authentication Bypass Using an Alternate Path or Channel
- Published
- 2026-08-02T00:16Z
- KEV added
- 2026-08-04 · due 2026-08-07
Affected products (1)
| Product | Versions | Fixed in |
|---|
| n-able/n-central | ≤ 2026.1 | — |
References (3)
EPSS history
Timeline