CISA has added CVE-2026-18577 to its Known Exploited Vulnerabilities Catalog after confirming active exploitation in the wild. The flaw is an authentication bypass in N-able N-central caused by an alternate path or channel that lets attackers sidestep authentication controls entirely.
Because N-central is an RMM platform widely used by MSPs and IT teams to manage large fleets of endpoints, an authentication bypass is especially dangerous—it can grant attackers privileged access to the management console and, by extension, downstream managed systems and the identities that operate them. Federal agencies are required to remediate under BOD 26-04, and CISA urges all organizations to prioritize patching.
What to take away: Treat internet-exposed RMM and management tooling as high-value identity targets. Patch immediately, hunt for signs of pre-patch compromise, and review privileged accounts and sessions tied to N-central.