[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fN-c9oXPC9tA7Mf4Lcpi3nRzC4_B7LV9L85hjoguLTQs":3},{"article":4,"iocs":49,"watch_terms":61,"solutions":62,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"d83edd78-5fbe-4ca2-8b0f-db4540921885","N-able warns of N-central auth bypass flaw exploited in attacks","n-able-warns-of-n-central-auth-bypass-flaw-exploited-in-attacks-1ebcd5","N-able is warning customers that hackers are exploiting an authentication bypass vulnerability (CVE-2026-18577) affecting both hosted and on-premises N-central servers. [...]","N-able released hotfix 2026.3.1.7 on August 2, 2026 to address CVE-2026-18577, an authentication bypass vulnerability affecting all N-central versions before 2026.3. The flaw, which allows administrative account takeover, is being actively exploited in the wild and represents an incomplete patch for the earlier CVE-2026-18576. Because N-central is a widely-used RMM platform for MSPs and enterprise IT, compromises can cascade to downstream customers.","N-able patches N-central auth bypass (CVE-2026-18577) under active exploitation","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fn-able-warns-of-n-central-auth-bypass-flaw-exploited-in-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F08\u002F18\u002FN-able.jpg","2026-08-03T17:00:56+00:00","2026-08-03T18:00:18.071197+00:00",9,[17,20,23,25],{"name":18,"type":19},"N-able","vendor",{"name":21,"type":22},"N-central","product",{"name":24,"type":22},"Cloudflared",{"name":26,"type":27},"RMM (Remote Monitoring and Management)","technology","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":28,"icon":30,"name":31,"slug":32},null,"Zero-day","zero-day",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",[50,54,57],{"type":51,"value":52,"context":53},"cve","CVE-2026-18577","Authentication bypass in N-central affecting all versions before 2026.3, actively exploited",{"type":51,"value":55,"context":56},"CVE-2026-18576","Prior authentication bypass vulnerability; CVE-2026-18577 is an incomplete patch for this flaw",{"type":58,"value":59,"context":60},"malware","Cloudflared (abuse)","Legitimate Cloudflare tunneling utility abused by attackers to create outbound tunnels and bypass firewalls",[18,21,24],{"controls":63,"vendors":147},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":94,"name":95,"problem":96,"products":97},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":123,"name":124,"problem":125,"products":126},"patch-management","Automated patch management","Known holes get closed in days, not months.",[127,135,139],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":123,"product_name":136,"url":137,"description":138},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":165},"n-central-auth-bypass-flaw-actively-exploited-msps-at-risk-of-cascading-compromise","N-central Auth Bypass Flaw Actively Exploited — MSPs at Risk of Cascading Compromise","CVE-2026-18577 is an authentication bypass vulnerability in N-able's N-central RMM platform that allows attackers to take over administrative accounts without valid credentials. The flaw is particularly dangerous because it represents an incomplete fix for a prior vulnerability (CVE-2026-18576), meaning organizations that believed they had patched the original issue remained exposed. Because N-central is used by Managed Service Providers (MSPs) to manage downstream customer environments, a single compromised instance can propagate attacks across dozens or hundreds of organizations. This illustrates the compounding risk of supply-chain-adjacent tools where one platform breach becomes a force multiplier for threat actors. Prompt application of hotfix 2026.3.1.7 is critical, but organizations must also audit for signs of prior compromise before assuming they are clean.",[153,154,155,156,157,158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","CIS Control 5: Account Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 IA-2: Identification and Authentication (MFA)","NIST SP 800-53 SR-6: Supplier Assessments and Reviews","NIST CSF ID.AM-2: Software platforms and applications inventoried","NIST CSF RS.MI-3: Newly identified vulnerabilities mitigated","ITIL Change Management: Emergency Change procedures","MITRE ATT&CK T1078: Valid Accounts (technique leveraged post auth bypass)","MITRE ATT&CK T1199: Trusted Relationship (MSP\u002Fsupply chain vector)",{}]