CVE-2026-18556Vulnerability
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
Reported by 4 independent sources · first reported by Sophos X-Ops · last reported
Last reported 1 month ago
Fix due 7 Aug 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 94% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
4 reports, newest first · the exact sentence from each-
August 2026 CVE Landscape“CVE-2026-18556”
-
N-able Releases Hotfix for Critical Remote Code Execution Vulnerability“CVE-2026-18556 and CVE-2026-18577 are high-severity authentication bypasses that were found to be exploited earlier in 2026 – and added to the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog in August.”
-
Critical N-able N-central Vulnerability and Active Exploitation“…nated vulnerabilities (CVE-2026-86206 and CVE-2026-86207), completely distinct from the flaws addressed by N-able's August hotfixes (CVE-2026-18556 and CVE-2026-18577).”
-
N-able N-central exploitation results in RMM tool deployment“An incomplete fix for CVE-2026-18556 published on August 1 has been reported as the underlying cause, though N-able has not directly confirmed the assertion.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-18577, CVE-2026-86218, CVE-2026-86206, CVE-2026-86207, CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-0300, CVE-2026-33017, CVE-2017-0199, CVE-2022-0847, CVE-2026-34486, CVE-2026-39987, CVE-2026-63030, CVE-2021-3156, CVE-2021-29441, CVE-2026-3055
Thanks — we review every report.