HIGHVulnerability
Verified
Global

CISA KEV: N-able N-central — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.

Analysis

N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556. Added to CISA Known Exploited Vulnerabilities catalog on 2026-08-03. Remediation due: 2026-08-06.

Indicators of Compromise (2)

CVE (2)
CVE-2026-18556
NVDMITRE CVE
CVE-2026-18577
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Aug 3, 2026. Verified by: CISA.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-108109 — PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the c...

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

CVE-2026-108109
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-108107 — PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerabi...

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

CVE-2026-108107
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-108101 — HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulne...

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

CVE-2026-108101
NIST NVD