CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild
2026-08-05T19:23:37Z•b82c1f4cd80243973ceae9a992320ebd4f9d5a96348b1a53c92ab00ee6c97680
CVE-2026-18556CVE-2026-18577CVE-2026-66066Active StorageN-able N-centralRMMRuby on Railsactive exploitationarbitrary file readauthentication bypasslibvipsmanaged service providerspossible remote code executionprivilege escalationremote unauthenticated
What happened
Rapid7 reports active exploitation of CVE-2026-18577, an authentication bypass in N-able N-central caused by an incomplete fix for CVE-2026-18556. Remote unauthenticated attackers can obtain administrative control of vulnerable N-central servers, creating significant downstream risk because N-central is an RMM platform with privileged access to managed environments. The document also covers CVE-2026-66066, a critical arbitrary file-read vulnerability in Ruby on Rails Active Storage when using libvips/Vips with untrusted uploads; exposed secrets may enable remote code execution. A separate item
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- b82c1f4cd80243973ceae9a992320ebd4f9d5a96348b1a53c92ab00ee6c97680
- Enrichment time
- 2026-08-05T19:23:37Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.