N-able N-central Authentication Bypass (CVE-2026-18556)

Risk Assessment

CISA has added an authentication bypass vulnerability in N-able N-central to its Known Exploited Vulnerabilities catalog, meaning federal agencies must patch by August 7, 2026. N-central is a primary RMM platform used by MSSPs to manage client endpoints at scale, which makes this vulnerability a direct attack surface against the MSSP's own management infrastructure. If this is in the KEV catalog, treat active exploitation as already underway.

Your N-central instance is not just your tool, it is a master key to every client network you manage, and an authentication bypass means an attacker does not need your credentials to walk through the front door. On the client advisory side, if a threat actor pivots from your N-central instance into client environments before you have communicated this risk, you own that silence in every conversation that follows. Your managed service agreement likely includes a duty to notify, and this is exactly the scenario that tests whether you take that seriously.