Authentication bypass via an alternate path or channel allows an attacker to circumvent normal authentication controls and gain administrative privileges within N‑central. The weakness, classified as CWE‑288, removes the ability of the system to reliably verify a user’s identity, enabling unauthorized control over configuration, data, and potentially the entire network infrastructure. This can result in full system compromise, data exfiltration, and denial of service if the attacker misconfigures critical settings.

The vulnerability affects N‑able’s N‑central product, with all releases through version 2026.1 susceptible. The issue applies to all installations of N‑central that rely on the default authentication flow exposed over the network.

The CVSS score of 8.2 indicates high severity, while the EPSS score under 1% suggests low but non‑zero exploitation probability. The vulnerability is listed in the CISA KEV catalog. Based on the description, the attacker can exploit the authentication bypass remotely without needing valid credentials, typically by accessing the admin interface via a non‑authenticated request path. Successful exploitation would grant the attacker unrestricted administrative privileges.