N-able vulnerabilities
28 CVEs and advisories name N-able as an affected vendor, 5 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-125880Stored XSS via MMS3 patch metadata (admin context)
- CVE-2026-125882RCE via file repository upload path traversal
- CVE-2026-125881Schema-hint SSRF via service import schema validation
- CVE-2026-125879Local privilege escalation to root via nable-writable syslog-ng config
- CVE-2026-125878Multiple OGNL Injection vulnerabilities
- CVE-2026-125958Root RCE via unsigned NSP upgrade package upload
- CVE-2026-91000Insecure IPC Channels lead to local privilege escalation
- CVE-2026-125883Multiple XXE Vulnerabilities
- CVE-2025-68624N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound ema
- CVE-2026-86218pre-authentication remote code execution
- CVE-2026-86206Access control filter bypass allows unauthorised access to APIs
- CVE-2026-86207Authentication bypass leads to unauthorised access to N-central
- CVE-2026-15580PassPortal browser extension: vault token disclosure via unvalidated postMessage
- CVE-2026-18577Incomplete patch leads to administrative account takeover
- CVE-2026-18556Unauthenticated administrative account takeover
- CVE-2025-11367N-central windows software probe Remote Code Execution
- CVE-2025-11366N-central Authentication bypass via path traversal
- CVE-2025-11700N-central Multiple XXE Injection Vulnerabilities
- CVE-2025-9316N-central unauthenticated sessionID generation
- CVE-2025-10231N-central Incorrect Default Permissions could lead to Privilege Escalation
- CVE-2025-7051N-central Syslog Configuration Insecure Direct Object Reference
- CVE-2025-8875Insecure Deserialization Vulnerability
- CVE-2025-8876Command Injection Vulnerability
- CVE-2024-8510N-central Path Traversal
- CVE-2024-5445Ecosystem Agent Insufficient Transport Layer Security
- CVE-2024-28200N-central Authentication Bypass
- CVE-2024-5322N-central Authentication Bypass via Session Rebinding
- CVE-2023-37244Privilege escalation in N-Able's AutomationManagerAgent