CVE-2026-18577

HighCVSS 8.1/10Known exploited (CISA KEV)Last modified Oct 23, 2026

Description

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published
Aug 2, 2026
Last modified
Oct 23, 2026
Added to CISA KEV
Aug 3, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-185797.2The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all veCVE-2026-18584.8wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (witCVE-2026-185813.3A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/CVE-2026-185825.3A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Reporting_RCBWriteAcceCVE-2026-185835.3A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/CVE-2026-185845.4A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown funCVE-2026-185854.3A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 2026CVE-2026-185867.2The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via CVE-2026-185877.5A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. ExecCVE-2026-185889.8A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation oCVE-2026-185899.8A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulatCVE-2026-185906.3A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the compone
CVE-2026-18577: High severity, CVSS 8.1 | Vulnix