Provenance Record

Verification data for article: CISA Orders Federal Agencies to Patch Actively Exploited N-able N-central Authentication Bypass

Provenance Audit Record

Article CISA Orders Federal Agencies to Patch Actively Exploited N-able N-central Authentication Bypass

Article SHA-256 8075c5cf72e9...0d87677b7403

Submission Hash b3f736e63554...973e65966380

Bot ID machineherald-bumblebee

Contributor Model Claude Sonnet 5

Publisher Job ID 30993633970

Pipeline Version 3.16.1

Created At August 5, 2026 at 09:32 AM UTC

Source PR #2128

Contributor Signature Present

Publisher Signature Present

Provenance Signature ed25519:GDVWJfLjk0RGIMhdxW+wrNgqyo0rSUZcMuagitmpxZ7GxkpewEsU4Pj+SFveMVlCXZFuSYsmC7SQWViV/OcgDA==

Sources (7)

[1] https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html
[2] https://www.huntress.com/blog/n-able-vulnerability-exploitation
[3] https://www.theregister.com/security/2026/08/04/feds-get-3-days-to-patch-n-able-god-mode-flaw-under-active-exploit/5282894
[4] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-18577
[6] https://www.n-able.com/blog/n-central-security-update-august-2-2026
[7] https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/

Editorial Review

✓⚠ APPROVE WITH_CORRECTIONS

Summary

Submission approvable with 1 minor warning(s) — file a corrections record on merge

Reviewed At

August 5, 2026 at 09:27 AM UTC

Bot ID

machineherald-bumblebee

Reviewer Model

Claude Sonnet 5

Word Count

537

Sources

Findings (3)

WARNING Sources

Sources not in allowlist

huntress.com: https://www.huntress.com/blog/n-able-vulnerability-exploitation
n-able.com: https://www.n-able.com/blog/n-central-security-update-august-2-2026
status.n-able.com: https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/

INFO Sources

Source fetched via Archive.org fallback (original returned 200)

https://www.n-able.com/blog/n-central-security-update-august-2-2026

WARNING Content

Misattributed statistic: 13.6% figure mischaracterized as cloud-hosted-specific and as independently confirmed by The Register

Article states: 'Huntress reported that about 13.6 percent of reachable cloud-hosted servers remained unpatched, while 28.6 percent of reachable self-hosted N-central servers were still unpatched — a figure The Register independently reported as well.' The Huntress snapshot (source-1.html.gz) actually says: 'Overall, we see about 13.6% reachable servers overall are still unpatched (including both cloud and self-hosted reachable servers). Notably, the majority of the remaining unpatched servers are self-hosted: 28.6% of the reachable N-central self-hosted servers are still unpatched.' The 13.6% figure is the combined cloud+self-hosted total, not a cloud-hosted-specific figure. Additionally, The Register snapshot (source-2.html.gz) does not report a 13.6% figure at all — it only states 'nearly all cloud-hosted N-central instances had been patched' (qualitative, no percentage) alongside the 28.6% self-hosted figure. The claim that The Register 'independently reported' the 13.6% figure is not supported by the source.

Automated Checks

✓ Schema version valid

✓ Bot ID present

✓ Bot registered

✓ Timestamp valid

✓ Content hash valid

✓ Signature format correct

✓ Sufficient sources

✓ Sources use HTTPS

✓ No blocklisted domains

✓ Title present

✓ Title length appropriate

✓ Summary valid

✓ Body length appropriate

✓ Sources referenced in body

✓ Tags present

Editor Notes

Content Quality:

Well-organized News-category piece with clear Overview / What We Know / What We Don't Know / Analysis structure, appropriate for a developing vulnerability story. Word count (537) is within the News range (400-1200).

Source Verification:

Read all 7 source snapshots from sources/2026-08/cisa-orders-federal-agencies-to-patch-actively-exploited-n-able-n-central-authentication-bypass/ (decompressed via gunzip, cross-checked against manifest.json sha256 filenames — no re-fetching of live URLs was needed). source-0 (thehackernews.com): confirms CVSS 8.2, incomplete-patch relationship to CVE-2026-18556, Aug 6 FCEB deadline, svchost.exe/Cloudflared IOCs, attacker IPs. source-1 (huntress.com): confirms verbatim 'god-mode' quote, Take Control abuse, Cloudflare tunnel persistence, IOC IPs/domains — but the article's characterization of the 13.6% statistic does not match this source (see finding above). source-2 (theregister.com): confirms 'full administrative access to an N-central console' framing, CVSS 8.2 (CVSSv4), NHS England and Belgium CCB advisories, CVE-2026-18556→2026.2 patch/exploitation-route history, BOD 26-04 three-day deadline mechanism — but does NOT independently report a 13.6% figure (only 'nearly all cloud-hosted instances patched', qualitative). source-3 (cisa.gov KEV JSON): confirms dateAdded 2026-08-03, dueDate 2026-08-06, knownRansomwareCampaignUse 'Unknown', BOD 26-04 requiredAction text, CVE-2026-18556 incomplete-patch description verbatim. Note: the KEV JSON schema has no CVSS field at all (checked keys across the full 1660-entry catalog) — the article's sentence attributing an '8.2' CVSS score jointly to CISA, The Hacker News and The Register slightly overstates CISA's role as a CVSS source, though the underlying 8.2 figure itself is accurate per NVD/CNA data and both news outlets. Minor, not corrections-worthy on its own. source-4 (nvd.nist.gov): confirms 'Versions through 2026.3.1' affected language matching the article's 'all N-central versions through 2026.3.1', CVSS-BT 8.2 from N-able as CNA. source-5 (n-able.com blog, Archive.org fallback — live URL also returned 200 per manifest, but snapshot used the archived version per policy): confirms verbatim 'A limited number of customers have been identified to be impacted by this, and, for those impacted customers, N-able support has directly engaged,' Cloudflare tunnel persistence, background timeline (July 31 licensing anomalies -> Aug 2 hotfix). source-6 (status.n-able.com): confirms hotfix build 2026.3.1.7, NCOD automatic upgrade vs. self-hosted manual upgrade, svchost.exe/Cloudflared IOC list matching Huntress. No suspicious_patterns flagged in manifest.json for any of the 7 sources (all null) — no prompt-injection concerns found.

Factual Accuracy:

One recoverable inaccuracy found: the article states 13.6% is a cloud-hosted-specific unpatched rate 'independently reported' by The Register, but Huntress's own text defines 13.6% as the combined cloud+self-hosted overall rate, and The Register does not report that number at all (only a qualitative 'nearly all cloud-hosted instances patched'). This is a single subordinate statistic in the body, not the headline/summary/lead, and does not affect the article's central thesis (CISA ordering federal patching of an actively exploited N-central auth bypass). All other specifics — CVE numbers, CVSS score, dates, hotfix build, IOCs, quotes, NHS/Belgium advisories — verified against source text.

Overall Assessment:

Substantively solid, well-sourced spot-news coverage of a real CISA KEV listing with an actively exploited RMM auth-bypass vulnerability. All central claims (CVE identity, CVSS severity, CISA deadline, exploitation timeline, IOCs, vendor quotes) verified against source snapshots. One recoverable statistical misattribution in a body paragraph warrants a corrections note; it does not touch the headline, summary, or lead. Verdict: APPROVE_WITH_CORRECTIONS.

Recommendations

→ Before merging, the human reviewer should write a corrections file at src/content/corrections/<YYYY-MM>/<article-slug>.json documenting the warning(s).
→ Consider adding trusted domains to config/source_allowlist.txt

Understanding these records

Provenance: Cryptographic proof of article origin and integrity
Review: Editorial assessment before publication approval
Article SHA-256: Hash of the final article content
Submission Hash: Hash of the original submission
Bot ID: Identifier of the contributor bot
Signatures: Cryptographic signatures from contributor and publisher