The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high‑severity vulnerability in N‑able N‑central to its Known Exploited Vulnerabilities catalog after reports of active exploitation. The flaw, identified as CVE‑2026‑18577, stems from incomplete patching of a prior issue, CVE‑2026‑18556.
CISA Adds Exploited N‑able N‑central Flaw to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Monday that a high‑severity flaw in N‑able N‑central has been added to its Known Exploited Vulnerabilities (KEV) catalog. The update follows reports of active exploitation in the wild.
The vulnerability, tracked as CVE‑2026‑18577, carries a CVSS score of 8.2. It is a case of incomplete patching for a prior issue, CVE‑2026‑18556, also rated 8.2.
According to the agency, the flaw allows attackers to gain unauthorized access to administrative functions within the N‑central platform. Once inside, an attacker can read, modify, or delete configuration data, potentially exposing sensitive network information.
Investigators have confirmed that the vulnerability is already being used by threat actors. The exploitation involves sending specially crafted requests to the N‑central API, bypassing authentication checks.
Because the flaw affects a widely deployed remote‑management solution, the risk is significant for organizations that rely on N‑able for monitoring and configuration.
To mitigate the risk, N‑able has released a patch that addresses the underlying issue. Users are urged to apply the update immediately and verify that the new security controls are in place.
Security teams should also review audit logs for signs of unauthorized activity and consider tightening network segmentation around N‑central endpoints.
CISA Adds Exploited N‑able N‑central Flaw to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Monday that a high‑severity flaw in N‑able N‑central has been added to its Known Exploited Vulnerabilities (KEV) catalog. The update follows reports of active exploitation in the wild.
The vulnerability, tracked as CVE‑2026‑18577, carries a CVSS score of 8.2. It is a case of incomplete patching for a prior issue, CVE‑2026‑18556, also rated 8.2.
According to the agency, the flaw allows attackers to gain unauthorized access to administrative functions within the N‑central platform. Once inside, an attacker can read, modify, or delete configuration data, potentially exposing sensitive network information.
Investigators have confirmed that the vulnerability is already being used by threat actors. The exploitation involves sending specially crafted requests to the N‑central API, bypassing authentication checks.
Because the flaw affects a widely deployed remote‑management solution, the risk is significant for organizations that rely on N‑able for monitoring and configuration.
To mitigate the risk, N‑able has released a patch that addresses the underlying issue. Users are urged to apply the update immediately and verify that the new security controls are in place.
Security teams should also review audit logs for signs of unauthorized activity and consider tightening network segmentation around N‑central endpoints.