Critical Alert 1 Active Exploit Detected Today

CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability →
Powered by CVE Watchtower
×
August 4, 2026

CVE Watchtower


← Back to CVE List

CVE-2026-25789NVD

Vulnerability Summary

Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file to be uploaded. This would result in malitcious JavaScript execution in the context of the authenticated user's session without requiring the file to be uploaded, potentially leading to session hijacking or credential theft.
Severity Level
HIGH(7.1)
Published Date
May 12, 2026
Last Modified
Jul 14, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.28%Probability
Root Weakness (CWE)
N/A
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredLow
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh