Skip to content
OpenAdvisories

Vendor

N-able

28 known vulnerabilities.

N-able at a glance

Last 12 months
19
Critical · all time
9
Exploited · all time
5
Public exploit · all time
6
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 3 vulnerabilities September 2026: 4 vulnerabilities, 1 critical Sep October 2026: 0 vulnerabilities November 2026: 8 vulnerabilities, 2 critical
Show as table
MonthVulnerabilitiesCritical
Nov 202682
Oct 202600
Sep 202641
Aug 202630
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202542
Oct 202500
Sep 202510
Aug 202532
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202510
Feb 202500
Jan 202500
Dec 202400

Products

N-central 24 Ecosystem Agent 1 AutomationManagerAgent 1 Mail Assure 1 PassPortal 1

Latest advisories

  • High max 9.3
    NCSC-2026-0478 7 CVEs

    Kwetsbaarheden verholpen in N-able N-central

    N-able heeft meerdere kwetsbaarheden verholpen in N-able N-central. Deze kwetsbaarheden treffen versies ouder dan 2026.4.1.26.

    N-able
  • High max 9.3
    WID-SEC-2026-4440 8 CVEs rev. 2

    N-able N-Central: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in N-able N-Central ausnutzen, um vertrauliche Informationen offenzulegen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Administratorrechte zu erlangen oder beli…

    N-able Windows
    first Nov 9, 2026
  • Critical max 10.0
    NCSC-2026-0342 1 CVE 1 exploited rev. 2

    Kwetsbaarheid verholpen in N-central van N-able

    N-able heeft een kwetsbaarheid verholpen in N-central versies eerder dan 2026.3.1.14.

    N-able
    first Sep 7, 2026
  • Critical max 10.0
    WID-SEC-2026-3205 3 CVEs 1 exploited rev. 2

    N-able N-Central: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in N-able N-Central ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder Code auszuführen.

    N-able Linux Windows
    first Sep 6, 2026
  • High max 8.2
    NCSC-2026-0275 2 CVEs 2 exploited rev. 2

    Kwetsbaarheden verholpen in N-able N-central

    N-able heeft kwetsbaarheden verholpen in N-able N-central tot en met versie 2026.3.1.

    N-able
    first Aug 3, 2026
All Critical High Medium Low Exploited only Public exploit

28 results · Feed

  • High 8.3
    CVE-2026-125880

    Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Script…

    N-able N-central
  • High 8.6
    CVE-2026-125882

    Relative path traversal vulnerability in N-able N-central allows Path Traversal. This issue affects N-central: before 2…

    N-able N-central
  • Critical 9.3
    CVE-2026-125881

    Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue aff…

    N-able N-central
  • High 8.6
    CVE-2026-125879

    Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-cent…

    N-able N-central
  • High 8.7
    CVE-2026-125878

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central …

    N-able N-central
  • High 7.5
    CVE-2026-125958

    Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue aff…

    N-able N-central
  • High 8.4
    CVE-2026-91000

    Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue …

    N-able N-central
  • Critical 9.3
    CVE-2026-125883

    Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. Th…

    N-able N-central
  • Medium 4.3
    CVE-2025-68624

    N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user…

    N-able Mail Assure
  • Critical 10.0
    CVE-2026-86218 Exploited Public exploit EPSS 15%

    pre-authentication remote code execution

    N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

    N-able N-central
    KEV Sep 8, 2026
  • Medium 6.9
    CVE-2026-86206

    Access control filter bypass allows unauthorised access to APIs

    A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4

    N-able N-central
  • High 7.7
    CVE-2026-86207

    Authentication bypass leads to unauthorised access to N-central

    An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs

    N-able N-central
  • Medium 6.9
    CVE-2026-15580

    PassPortal browser extension: vault token disclosure via unvalidated postMessage

    vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.

    N-able PassPortal
  • High 8.2
    CVE-2026-18577 Exploited Public exploit EPSS 15%

    Incomplete patch leads to administrative account takeover

    An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

    N-able N-central
    KEV Aug 3, 2026
  • High 8.2
    CVE-2026-18556 Exploited Public exploit

    Unauthenticated administrative account takeover

    Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

    N-able N-central
    KEV Aug 4, 2026
  • Critical 10.0
    CVE-2025-11367

    N-central windows software probe Remote Code Execution

    The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization

    N-able N-central
  • Critical 9.4
    CVE-2025-11366

    N-central Authentication bypass via path traversal

    N-central < 2025.4 is vulnerable to authentication bypass via path traversal

    N-able N-central
  • High 8.4
    CVE-2025-11700 Public exploit EPSS 32%

    N-central Multiple XXE Injection Vulnerabilities

    N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure

    N-able N-central
  • Medium 6.9
    CVE-2025-9316 Public exploit EPSS 37%

    N-central unauthenticated sessionID generation

    N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.

    N-able N-central
  • High 7.0
    CVE-2025-10231

    N-central Incorrect Default Permissions could lead to Privilege Escalation

    An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions.

    N-able N-central
  • High 8.3
    CVE-2025-7051

    N-central Syslog Configuration Insecure Direct Object Reference

    On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.

    N-able N-central
  • Critical 9.4
    CVE-2025-8875 Exploited Public exploit

    Insecure Deserialization Vulnerability

    Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

    N-able N-central
    KEV Aug 13, 2025
  • Critical 9.4
    CVE-2025-8876 Exploited

    Command Injection Vulnerability

    Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

    N-able N-central
    KEV Aug 13, 2025
  • Medium 5.3
    CVE-2024-8510

    N-central Path Traversal

    N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerability is present in all deployments of N-central prior to N-central 2024.6.

    N-able N-central
  • Low 3.8
    CVE-2024-5445

    Ecosystem Agent Insufficient Transport Layer Security

    Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers fro…

    N-able Ecosystem Agent
  • Critical 9.1
    CVE-2024-28200

    N-central Authentication Bypass

    The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered through internal N-central source code review and N-able has…

    N-able N-central
  • Critical 9.1
    CVE-2024-5322

    N-central Authentication Bypass via Session Rebinding

    The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. This vulnerability is present in all Entra-supported deployments of N-central prior to 2024.3.

    N-able N-central
  • Medium 5.3
    CVE-2023-37244

    Privilege escalation in N-Able's AutomationManagerAgent

    The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp, which could be leveraged by an attac…

    N-able AutomationManagerAgent