CVE-2026-18577 is a high-severity authentication bypass vulnerability (CWE-288) affecting the N-able N-central platform. It allows remote unauthenticated attackers to bypass authentication mechanisms and gain administrative privileges on N-central servers. Exploitation has been observed in the wild since August 1, 2026, shortly before the vulnerability was added to CISA's Known Exploited Vulnerability catalog. Attackers have abused the Take Control functionality for remote access to managed endpoints and deployed Cloudflare Tunnel (cloudflared) to maintain persistent access. This vulnerability arose due to an incomplete fix of a prior authentication bypass flaw (CVE-2026-18556). No official remediation or patch has been confirmed as of the publication date.

Successful exploitation grants attackers administrative control over N-able N-central servers, enabling them to remotely access managed endpoints and maintain persistent access via Cloudflare Tunnel. This compromises the security of downstream managed systems and potentially the broader IT environments managed through N-central. The vulnerability is actively exploited in the wild, increasing the risk to organizations using this platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor N-able's advisories closely. Until a patch is available, consider restricting network access to N-central management interfaces and applying compensating controls to limit exposure. Follow vendor guidance once published.