KEV Lag Tracker → CVE-2026-18577. Data verified against the official CISA KEV catalog and the National Vulnerability Database.
CISA added CVE-2026-18577 (N-able N-central) to the Known Exploited Vulnerabilities catalog on August 3, 2026. It was publicly known for 1 day before CISA confirmed active exploitation. A KEV listing is CISA’s official confirmation that a vulnerability is being exploited in the wild.
The Record
| CVE | CVE-2026-18577 |
| Vendor / product | N-able N-central |
| Vulnerability | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability |
| CVSS base score | — |
| NVD publication date | August 2, 2026 |
| Added to CISA KEV | August 3, 2026 |
| Lag (public → KEV listing) | 1 days |
| Federal patch deadline | August 6, 2026 |
| Known ransomware use | No |
Measured against the 1674 entries in our tracker with verified publication dates, CVE-2026-18577 was flagged faster than 84% of them.
What CISA Reported
CISA describes the flaw as follows: “N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.”
Federal Patch Deadline
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-18577 by August 6, 2026 — a 3-day remediation window from the KEV listing date. Private organizations are not bound by that deadline; CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
What EPSS Forecast Before the Confirmation
EPSS had no score for CVE-2026-18577 on the day before CISA confirmed exploitation. That normally means the CVE had not yet been published when it was already being exploited — a case no forecast could have flagged. Its current EPSS probability is 6.15%. See the EPSS accuracy analysis for how often this happens.
How This Compares
We do not yet track enough N-able entries to publish a vendor median (the threshold is five with verified publication dates), so the reference here is the catalog as a whole:
| Across all tracked KEV entries | Value |
|---|---|
| Entries with verified publication dates | 1674 |
| Median lag (disclosure → KEV listing) | 266 days |
| Exploited within 7 days of disclosure | 24% |
| Tied to known ransomware campaigns | 20% |
Other Recent N-able KEV Additions
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-18556 | N-central | August 4, 2026 | 3 | No |
| CVE-2025-8875 | N-Central | August 13, 2025 | -1 | No |
| CVE-2025-8876 | N-Central | August 13, 2025 | -1 | No |
Frequently Asked Questions
What is CVE-2026-18577?
CVE-2026-18577 is a vulnerability in N-able N-central (N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability) that CISA added to its Known Exploited Vulnerabilities catalog on August 3, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild.
How long was CVE-2026-18577 public before CISA confirmed exploitation?
1 calendar days, measured from its NVD publication date to the date CISA added it to the KEV catalog.
What is the federal patch deadline for CVE-2026-18577?
U.S. federal agencies must remediate CVE-2026-18577 by August 6, 2026, a 3-day window from the KEV listing date. Private organizations are not bound by that deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
Is CVE-2026-18577 used in ransomware campaigns?
CISA has not flagged CVE-2026-18577 as known to be used in ransomware campaigns. That field reflects confirmed campaign use, not the absence of risk.
Is a 1-day lag typical?
The median across all 1674 KEV entries we track with verified publication dates is 266 days, so CVE-2026-18577 is below the catalog median.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
Primary Sources
- CISA Known Exploited Vulnerabilities Catalog — the official listing that confirms active exploitation, and the source of the KEV date on this page.
- NVD — CVE-2026-18577 — publication date, CVSS score and the full technical record.
- Vendor advisory — documentation.n-able.com — N-able’s own disclosure, with the affected versions and the fix.
- Vendor advisory — status.n-able.com — N-able’s own disclosure, with the affected versions and the fix.
How We Track This
This page is generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No date or figure on this page is estimated or taken from a third-party source — they come directly from CISA and NVD records. Free to cite with attribution to CVEDaily (CC BY 4.0).