N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This v…

CVE-2026-18577 is a critical authentication bypass vulnerability affecting N-able N-central, exploiting an alternate path or channel to allow authentication bypass and full account takeover. The vulnerability is the result of an incomplete patch for a prior related vulnerability, CVE-2026-18556. N-able has released N-central 2026.3 Hotfix 1 to address this issue. The flaw is tracked by CISA and listed under BOD 26-04, which prioritizes security updates based on risk. Organizations using N-able N-central are urged to apply the hotfix immediately. Forensic triage requirements have also been outlined in CISA's BOD 26-04 implementation guidance. The vulnerability poses significant risk as it enables unauthorized access and potential full compromise of managed endpoints through the N-central platform.