PT-2026-67139 · N-Central · N-Central

CVE-2026-18577 · Published 2026-08-02 · Updated 2026-08-03

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2026.3.2

Description An incomplete patch allows for authentication bypass and account takeover. This issue occurs when an attacker uses an alternate path or channel to bypass the authentication mechanism.

Recommendations Update N-central to version 2026.3.2 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-18577

Affected Products

N-Central

References · 5

• https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-18556 · Security Note
• https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-18577 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18577 · Note