Three More Vulnerabilities Went On The Actively Exploited List This Month

CVE-2026-18577 is an authentication bypass in N-able N-central that leads to full account takeover. CISA added it to the Known Exploited Vulnerabilities catalog after customer compromises, not after a researcher write-up.

N-central is remote monitoring and management software. It sits above hundreds of customer networks at once by design, holding the credentials and agent access needed to administer all of them. Compromise the RMM and you inherit everything underneath it.

The other CVE-2026-18577 neighbours on the CISA list

Two more went on in the same week. CVE-2026-20349 affects Cisco Secure Firewall. CVE-2026-72898 is a SQL injection in Metabase, the open source business intelligence tool that a lot of teams point directly at their production database.

Separately, August Patch Tuesday cleared 421 CVEs from Microsoft in a single release. Buried in that pile is CVE-2026-68820, a use after free in the Windows WinSock ancillary function driver, already being used in the wild to escalate to SYSTEM.

All four are confirmed exploited. That is the distinction worth holding onto when triaging: the KEV catalog is not a list of things that could go wrong, it is a list of things that already have.

The pattern is management tooling

Look at what these have in common. Remote monitoring software. A firewall appliance. A BI tool with database credentials. Attackers have stopped trying the front door and started going through the thing that watches the front door, because that thing has legitimate access everywhere and generates alerts nobody reads.

It is the same shape as the Defender zero day earlier this year and the hypervisor escape research that followed it. Security and management layers are high-value targets precisely because they were built to be trusted.

The short version for patching

N-able N-central, authentication bypass, gives an attacker account takeover and downstream access to every managed estate. Cisco Secure Firewall, gives perimeter foothold. Metabase, SQL injection, gives whatever the database holds. Windows WinSock, gives privilege escalation to SYSTEM on an already-compromised host.

If you run any of the first three and have not patched, that is today's job rather than this sprint's.