id: CVE-2026-18577

info:
  name: "Nable - Authentication Bypass"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central
    Versions through 2026.3.1
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-18577&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=nable&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2026-18577
    cwe-id: CWE-288
  metadata:
    verified: false
  tags: cve,cve2026,n-able,ncentral,auth-bypass,kev,passive,vkev,nable
http:
  - method: GET
    path:
      - "{{BaseURL}}/login"

    matchers-condition: and
    matchers:
      - type: word
        condition: or
        words:
          - 'class="ncentral"'
          - 'ncentralVersion'

      - type: dsl
        dsl:
          - compare_versions(version, '< 2026.3.1.10')

    extractors:
      - type: regex
        name: version
        internal: true
        group: 1
        regex:
          - 'ncentralVersion:\s*"(202\d+\.\d+\.\d+\.\d+)"'

      - type: regex
        name: ncentral_version
        group: 1
        regex:
          - 'ncentralVersion:\s*"(202\d+\.\d+\.\d+\.\d+)"'