N-able N-central pre-auth administrative account takeover via alternate authentication path

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether the local N-able N-central installation is vulnerable to CVE-2026-18556 / CVE-2026-18577.
.DESCRIPTION
    Reads the N-central build version from the registry and compares against the
    fully patched build 2026.3.1.10 (Hotfix 2). Outputs VULNERABLE, PATCHED, or UNKNOWN.
.NOTES
    Run on the N-central server itself as a local administrator.
    Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

# Known safe build: 2026.3.1.10 (Hotfix 2) or later
$patchedBuild = [version]'2026.3.1.10'

try {
    # Check common registry paths for N-central installation
    $regPaths = @(
        'HKLM:\SOFTWARE\N-able Technologies\N-central',
        'HKLM:\SOFTWARE\SolarWinds MSP\N-central',
        'HKLM:\SOFTWARE\Wow6432Node\N-able Technologies\N-central'
    )

    $installedVersion = $null
    foreach ($path in $regPaths) {
        if (Test-Path $path) {
            $ver = (Get-ItemProperty -Path $path -ErrorAction SilentlyContinue).Version
            if ($ver) {
                $installedVersion = $ver
                break
            }
            $ver = (Get-ItemProperty -Path $path -ErrorAction SilentlyContinue).BuildVersion
            if ($ver) {
                $installedVersion = $ver
                break
            }
        }
    }

    # Fallback: check N-central service and install directory
    if (-not $installedVersion) {
        $svc = Get-Service -Name 'N-centralServer' -ErrorAction SilentlyContinue
        if (-not $svc) {
            $svc = Get-Service -Name 'NCentralServer' -ErrorAction SilentlyContinue
        }
        if (-not $svc) {
            # Try to find via installed programs
            $app = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' |
                   Where-Object { $_.DisplayName -like '*N-central*' -or $_.DisplayName -like '*N-Central*' } |
                   Select-Object -First 1
            if ($app -and $app.DisplayVersion) {
                $installedVersion = $app.DisplayVersion
            }
        }
    }

    if (-not $installedVersion) {
        Write-Host 'UNKNOWN - N-central installation not detected on this host.'
        Write-Host 'If N-central is installed, check manually: N-central Admin Console > About.'
        exit 2
    }

    Write-Host "Detected N-central version: $installedVersion"

    try {
        $current = [version]$installedVersion
    } catch {
        Write-Host "UNKNOWN - Could not parse version string: $installedVersion"
        exit 2
    }

    if ($current -ge $patchedBuild) {
        Write-Host "PATCHED - N-central $installedVersion is >= $patchedBuild (Hotfix 2)."
        Write-Host 'CVE-2026-18556 and CVE-2026-18577 are remediated.'
        exit 0
    } else {
        Write-Host "VULNERABLE - N-central $installedVersion is below $patchedBuild."
        Write-Host 'This instance is affected by CVE-2026-18556 (and likely CVE-2026-18577).'
        Write-Host 'ACTION: Upgrade immediately to N-central 2026.3 Hotfix 2 (build 2026.3.1.10) or later.'
        exit 1
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    exit 2
}