CVE-2026-18577 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-18577HIGH

N-able N-central — Incomplete patch leads to administrative account takeover

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   N   H   N   N    8.2   .0410   89.9   YES

AFFECTED
  Product    Versions     Fixed
  N-central  unspecified  2026.3.1.7

TIMELINE
  Aug 1   PATCH SHIPPED — CVE-2026-18577 (N-able N-central). Fixed in N-central 2026.3.1.7.
  Aug 2   Reserved by N-able
  Aug 3   Added to CISA KEV, remediation due 2026-08-06
  Aug 3   Published (CNA: N-able)
  Aug 7   DUE DATE PASSED — CVE-2026-18577 (N-able N-central). CISA remediation deadline was August 6, 2026; still in catalog.

CWE-288 · CNA: N-able · CVSS v4.0 · 5 references · NVD status: Analyzed · KEV due August 6, 2026

Description

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Lifecycle

Complete event history — 5 events, chronological
Date	Event	Detail
August 1, 2026	PATCH SHIPPED	PATCH SHIPPED — CVE-2026-18577 (N-able N-central). Fixed in N-central 2026.3.1.7.
August 2, 2026	Reserved	Reserved by N-able
August 3, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-08-06
August 3, 2026	Published	Published (CNA: N-able)
August 7, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-18577 (N-able N-central). CISA remediation deadline was August 6, 2026; still in catalog.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
N-able	N-central	—	—	2026.3.1.7

Weaknesses

CWE-288

References (5)

https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm [Patch, Release Notes]
https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/ [Release Notes]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18577 [US Government Resource]
https://www.cve.org/CVERecord?id=CVE-2026-18556 [VDB Entry]
https://www.n-able.com/blog/n-central-security-update-august-2-2026 [Vendor Advisory]

Authoritative record: CVE-2026-18577 at cve.org

Vendors: n-able

Weaknesses: CWE-288

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-18577 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.