CVE Explorer
CVE-2026-18556
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
This issue affects N-central: through 2026.1.
Known exploited
CISA KEV
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"N-central","vendor":"N-able","versions":[{"lessThanOrEqual":"2026.1","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:e2c50326336f7e976d1dad0ce0bd0baf0134ff6a38b348c58c39650912ebfa3b · sha256:f48500c28eb2fc39… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.2,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:e2c50326336f7e976d1dad0ce0bd0baf0134ff6a38b348c58c39650912ebfa3b · sha256:f48500c28eb2fc39… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-288","description":"CWE-288 Authentication bypass using an alternate path or channel","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:e2c50326336f7e976d1dad0ce0bd0baf0134ff6a38b348c58c39650912ebfa3b · sha256:f48500c28eb2fc39… · /containers/cna/problemTypes/0/descriptions/0
Known exploitation assertions
1 source assertion{"cwes":["CWE-288"],"dateAdded":"2026-08-04","dueDate":"2026-08-07","knownRansomwareCampaignUse":"Unknown","notes":"https://uptime.n-able.com/ ; https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-18556","product":"N-central","requiredAction":"Apply miti…
- cisa_kev_jsonknown_exploitedurn:baitaphish:normalized-source-record:v2:d242bed1a97be9a1a368c050cb3e4ec8d04ca80479131d9fb5348de6ab165bbe · sha256:635dff916c4092c0… · /vulnerabilities/0Open source location →
Source references
1 source assertion{"url":"https://uptime.n-able.com/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:e2c50326336f7e976d1dad0ce0bd0baf0134ff6a38b348c58c39650912ebfa3b · sha256:f48500c28eb2fc39… · /containers/cna/references/0
Attribution and limitations
- CISA Known Exploited Vulnerabilities JSON: CISA named for provenance; do not use CISA/DHS marks or imply endorsement Source →
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.