CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild
2026-08-05T07:23:39Z•b1b02a89d37500a576e4b368daa32e8bf70f08e060e6edd08743f26d98c80d49
CVE-2026-18556CVE-2026-18577CVE-2026-66066Active StorageMetasploitN-able N-centralRMMRuby on Railsarbitrary-file-readauthentication-bypassexploitation-in-the-wildlibvipsmanaged-service-providersprivilege-escalationremote-code-executionremote-unauthenticatedsecurity-eventsvulnerability
What happened
Rapid7 reporting highlights two significant 2026 vulnerabilities: CVE-2026-18577, an N-able N-central authentication bypass exploited in the wild that can grant unauthenticated attackers administrative control of RMM servers and downstream managed environments; and CVE-2026-66066, a critical Ruby on Rails Active Storage/libvips arbitrary file-read vulnerability that can expose application secrets and potentially enable remote code execution. The feed also contains Metasploit Pro product news, corporate partnership announcements, and Black Hat event information.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- b1b02a89d37500a576e4b368daa32e8bf70f08e060e6edd08743f26d98c80d49
- Enrichment time
- 2026-08-05T07:23:39Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.