CISA orders 3-day patch for N-able flaw

CISA added CVE-2026-18577 to its KEV catalog, giving federal agencies three days to patch an N-able N-central flaw granting full administrative access. Exploited since July 31, attacks pivoted into managed endpoints and created Cloudflare tunnels. Nearly 28.6% of self-hosted servers remained vulnerable by August 3.