CVE-2026-18556

N-able — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

CISA KEV · in the CISA KEV catalog since 2026-08-04

What EVULNABLE says

EVULNABLE Risk · priority 75/100 Urgent Raised to the floor for a confirmed exploited vulnerability. Intelligence coverage 75/90 — no pre-patch disclosure data

Overdue by 27 daysCISA KEVActively Exploited

Why it matters: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.

The priority band answers “how soon”, not “how bad” — see Methodology for what it weighs and where it abstains.

The evidence behind it

Published measurements for CVE-2026-18556
Measure	Value	Source
CVSS base score	8.2	NVD
FIRST EPSS	0.402 (98.5th pctl)	FIRST
Actively exploited	Confirmed	CISA KEV
Ransomware campaign use	Unknown or none	CISA KEV
CISA remediation deadline	2026-08-07 — Overdue by 27 days	CISA KEV

Intelligence coverage 75/90 — no pre-patch disclosure data

What CISA says to do

The primary records

This page is an opinion about urgency. Where it and a source of record disagree, the source of record is the record.

NVD ↗ CISA KEV ↗ Vendor Advisory ↗