N-able Releases Hotfix for Exploited N-central Authentication Bypass Flaw CVE-2026-18577
N-able has issued an emergency hotfix for a critical authentication bypass vulnerability in its N-central platform, which is widely used for remote monitoring and management of servers and network devices.
The vulnerability, identified as CVE-2026-18577, enables attackers to bypass authentication via alternative routes or channels, potentially leading to full account takeover. It impacts N-central 2026.1 and all prior versions.
Security researchers note that the issue arose because the earlier fix for CVE-2026-18556 proved insufficient, allowing the new bypass vector to emerge. The flaw received a CVSS v4.0 base score of 8.2 and is classified as High severity.
Active exploitation has already been confirmed, and Indicators of Compromise (IoCs) such as associated IP addresses have been published to help organizations detect potential intrusions.
On August 2, 2026, N-able released the official mitigation in the form of N-central 2026.3 Hotfix 1 (build 2026.3.1.7). While the company strongly recommends immediate deployment, it has not made the update mandatory. It also suggests updating management agents as an additional precaution.
Related articles
CISA Adds Zimbra Collaboration Suite CVE-2026-73570 to KEV Catalog After Confirmed Exploitation
US authorities have issued a warning about active exploitation of a vulnerability in the Zimbra Collaboration Suite. CISA added the OS command injection flaw CVE-2026-73570 to its Known Exploited Vulnerabilities catalog on August 21, 2026, marking the fifth such entry for the year. The issue resides in the SNMP monitoring component and allows unauthenticated attackers to execute arbitrary operating system commands with Zimbra user privileges when SNMP notifications are enabled. MITRE rated the vulnerability 8.9 on CVSS v3.1, classifying it as High severity. Federal agencies must apply mitigations by August 24, while all organizations using the product are urged to prioritize patching to prevent further abuse.
IBM Patches 191 Vulnerabilities in AIX and PowerVM VIOS Including Critical Remote Command Execution Flaws
IBM disclosed a large set of security vulnerabilities affecting its UNIX-based AIX operating system and the PowerVM VIOS virtualization component. The company addressed a total of 191 CVEs through multiple updated releases for both products. Thirty-five of the issues received CVSS base scores of 9.0 or higher, with three OS command injection vulnerabilities rated at 9.9 that allow remote attackers to execute commands with low privileges. IBM provided specific Technology Level and Service Pack updates for AIX 7.3 and 7.2 branches along with corresponding fixes for PowerVM VIOS versions 4.1.x. The advisory covers both IBM-developed code and third-party software components integrated into the platforms. All listed CVEs are now resolved in the recommended maintenance levels released on August 15.
Vulnaware Bridges Vulnerability Scanners and ITSM Systems to Improve Critical Flaw Prioritization
A new open-source tool called Vulnaware has been developed to address the persistent gap between vulnerability discovery and remediation in enterprise environments. The project focuses on intelligent prioritization rather than attempting to fix every reported CVE, recognizing that fewer than 10 percent of published vulnerabilities are ever exploited. It integrates outputs from MaxPatrol VM, Nessus Pro, and Greenbone/OpenVAS, then applies scoring based on CISA KEV catalog presence, public exploit availability from Vulncheck feeds, and trend data. Prioritized issues are automatically converted into tickets in Jira Service Management, GLPI, Znuny, and osTicket, while also delivering alerts via Telegram and email. The approach aligns with the updated CISA BOD 26-04 framework that replaced flat 15- and 25-day deadlines with risk-based timelines of 3, 14, or 60 days. By treating vulnerability remediation as a managed change or service request under ITIL4 principles, Vulnaware ensures that critical issues reach the correct engineering teams with proper SLA tracking.
PostgreSQL Releases Security Update Fixing 28 Vulnerabilities and Over 110 Bugs
The PostgreSQL development team issued a major security update on August 13, 2026, addressing 28 vulnerabilities along with more than 110 bugs. While no issues reached a CVSSv3.1 base score of 9.0 or higher, 18 vulnerabilities scored 7.0 or above, with 14 rated at 8.8. Several flaws enable arbitrary code execution, including heap buffer overflows in regular expression processing and the to_char function. Additional fixes cover heap buffer overflows in pg_stat_statements and pg_dump, type confusion issues, and an SQL injection vulnerability. The update resolves specific CVEs such as CVE-2026-14664, CVE-2026-14669, CVE-2026-14670, CVE-2026-16238, CVE-2026-16239, and CVE-2026-15741.