CISA Adds Exploited N-able N-central Flaw Enabling Remote Admin Takeover to KEV

**Executive summary:** CISA added CVE-2026-18577 — an actively exploited authentication bypass in N-able N-central — to its Known Exploited Vulnerabilities catalog; attackers have been observed gaining administrative access to N-central instances, abusing the platform’s 'Take Control' functionality and registering persistent Cloudflare Tunnel access, while N-able released a hotfix and flagged versions prior to 2026.3.1.7 as vulnerable.