CISA has added an actively exploited flaw in N-able N-central to its Known Exploited Vulnerabilities catalog, putting a platform that managed service providers use to administer their customers' networks on the federal must-fix list.
The agency listed CVE-2026-18577, described in its August 3, 2026 alert as an authentication bypass using an alternate path or channel, on the strength of evidence of active exploitation. That is the bar for entry to the catalog. CISA has not published exploitation details, affected version numbers or a severity score for this one, and N-able's own advisory is where that information will sit.
Why an RMM flaw is worth moving on
N-central is N-able's remote monitoring and management product. Tools in that category exist to reach into a large number of other people's machines from one console, which is precisely what makes them worth attacking: whoever reaches the console inherits its reach, and for a managed service provider that means client networks as well as its own. That, rather than any published detail about how this specific bug is triggered, is the argument for pulling it out of the routine patch queue.
What you should do
Check N-able's advisory for the fixed release and apply it. CISA notes that this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of high-risk catalog entries on publicly exposed assets, and also sets expectations for when agencies must check whether attackers compromised a system before the patch was applied. CISA encourages every organisation to adopt the same risk-based approach. The second half of that is the part most often skipped: where exploitation is already happening, patching a management platform without hunting for what came through it beforehand leaves the more expensive problem untouched.
IntelFusions tracks additions to the catalog as they land. Recent entries include four SharePoint flaws added during July and exploited Fortinet and Arista bugs.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.