Skip to content
OpenAdvisories

Product · N-able

N-central

24 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 8.3
    CVE-2026-125880

    Stored XSS via MMS3 patch metadata (admin context)

    Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). This issue affects N-central: before 26.4.1.

    N-able N-central
  • High 8.6
    CVE-2026-125882

    RCE via file repository upload path traversal

    Relative path traversal vulnerability in N-able N-central allows Path Traversal. This issue affects N-central: before 26.4.1.

    N-able N-central
  • High 8.6
    CVE-2026-125879

    Local privilege escalation to root via nable-writable syslog-ng config

    Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 26.4.1.

    N-able N-central
  • High 8.7
    CVE-2026-125878

    Multiple OGNL Injection vulnerabilities

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1.

    N-able N-central
  • High 7.5
    CVE-2026-125958

    Root RCE via unsigned NSP upgrade package upload

    Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central: through 24.6.1.

    N-able N-central
  • High 8.4
    CVE-2026-91000

    Insecure IPC Channels lead to local privilege escalation

    Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 2026.4.1.

    N-able N-central
  • High 7.7
    CVE-2026-86207 Scanner template

    Authentication bypass leads to unauthorised access to N-central

    An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs

    N-able N-central
  • High 8.2
    CVE-2026-18577 Exploited Public exploit Scanner template EPSS 15%

    Incomplete patch leads to administrative account takeover

    An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

    N-able N-central
    KEV Aug 3, 2026
  • High 8.2
    CVE-2026-18556 Exploited Public exploit EPSS 44%

    Unauthenticated administrative account takeover

    Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

    N-able N-central
    KEV Aug 4, 2026
  • High 8.4
    CVE-2025-11700 Public exploit Scanner template EPSS 32%

    N-central Multiple XXE Injection Vulnerabilities

    N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure

    N-able N-central
  • High 7.0
    CVE-2025-10231

    N-central Incorrect Default Permissions could lead to Privilege Escalation

    An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions.

    N-able N-central
  • High 8.3
    CVE-2025-7051

    N-central Syslog Configuration Insecure Direct Object Reference

    On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.

    N-able N-central