CVE-2026-18556

HighCVSS 7.4/10Known exploited (CISA KEV)Last modified Oct 23, 2026

Description

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.

This issue affects N-central: through 2026.1.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-288

Affected software

VendorProductVersions
N-ableN-central<= 2026.1

References

Timeline

Published
Aug 1, 2026
Last modified
Oct 23, 2026
Added to CISA KEV
Aug 4, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-185576.1The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'titCVE-2026-185586.4The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via tCVE-2026-18566.4The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom booking field labels in all veCVE-2026-185604.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before otheCVE-2026-185617.5The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, anCVE-2026-185626.1The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendCVE-2026-185674.7IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable UnCVE-2026-185687.5XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skCVE-2026-185693.7A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. ThisCVE-2026-18574.3The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inclCVE-2026-185705.4A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible forCVE-2026-185717.2A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a
CVE-2026-18556: High severity, CVSS 7.4 | Vulnix