CVE-2026-18577 PoC — Incomplete patch leads to administrative account takeover

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18577.yaml

Associated Vulnerability

Title: Incomplete patch leads to administrative account takeover (CVE-2026-18577)
Description:An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Description

N-able N-central versions through 2026.3.1 contain an authentication bypass that lets a remote unauthenticated attacker take over an administrator account and gain full control of the N-central server. CVE-2026-18577 is a bypass of the incomplete fix for CVE-2026-18556, so the 2026.3.1 Hotfix 1 build (2026.3.1.7) does not fully remediate it. Hotfix 2 (2026.3.1.10) supersedes Hotfix 1 and is the first fully fixed 2026.3 build.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →