# cve.now: N-able

The newest entries naming N-able as an affected vendor (up to 200), of 28 in all, 5 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125880](https://cve.now/CVE-2026-125880.md): Stored XSS via MMS3 patch metadata (admin context) (CVSS 8.3)
- [CVE-2026-125882](https://cve.now/CVE-2026-125882.md): RCE via file repository upload path traversal (CVSS 8.6)
- [CVE-2026-125881](https://cve.now/CVE-2026-125881.md): Schema-hint SSRF via service import schema validation (CVSS 9.3)
- [CVE-2026-125879](https://cve.now/CVE-2026-125879.md): Local privilege escalation to root via nable-writable syslog-ng config (CVSS 8.6)
- [CVE-2026-125878](https://cve.now/CVE-2026-125878.md): Multiple OGNL Injection vulnerabilities (CVSS 8.7)
- [CVE-2026-125958](https://cve.now/CVE-2026-125958.md): Root RCE via unsigned NSP upgrade package upload (CVSS 7.5)
- [CVE-2026-91000](https://cve.now/CVE-2026-91000.md): Insecure IPC Channels lead to local privilege escalation (CVSS 8.4)
- [CVE-2026-125883](https://cve.now/CVE-2026-125883.md): Multiple XXE Vulnerabilities (CVSS 9.3)
- [CVE-2025-68624](https://cve.now/CVE-2025-68624.md): N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound ema (CVSS 4.3)
- [CVE-2026-86218](https://cve.now/CVE-2026-86218.md): pre-authentication remote code execution (CVSS 10.0, KEV)
- [CVE-2026-86206](https://cve.now/CVE-2026-86206.md): Access control filter bypass allows unauthorised access to APIs (CVSS 6.9)
- [CVE-2026-86207](https://cve.now/CVE-2026-86207.md): Authentication bypass leads to unauthorised access to N-central (CVSS 7.7)
- [CVE-2026-15580](https://cve.now/CVE-2026-15580.md): PassPortal browser extension: vault token disclosure via unvalidated postMessage (CVSS 6.9)
- [CVE-2026-18577](https://cve.now/CVE-2026-18577.md): Incomplete patch leads to administrative account takeover (CVSS 8.2, KEV)
- [CVE-2026-18556](https://cve.now/CVE-2026-18556.md): Unauthenticated administrative account takeover (CVSS 8.2, KEV)
- [CVE-2025-11367](https://cve.now/CVE-2025-11367.md): N-central windows software probe Remote Code Execution (CVSS 10.0)
- [CVE-2025-11366](https://cve.now/CVE-2025-11366.md): N-central Authentication bypass via path traversal (CVSS 9.4)
- [CVE-2025-11700](https://cve.now/CVE-2025-11700.md): N-central Multiple XXE Injection Vulnerabilities (CVSS 8.4)
- [CVE-2025-9316](https://cve.now/CVE-2025-9316.md): N-central unauthenticated sessionID generation (CVSS 6.9)
- [CVE-2025-10231](https://cve.now/CVE-2025-10231.md): N-central Incorrect Default Permissions could lead to Privilege Escalation (CVSS 7.0)
- [CVE-2025-7051](https://cve.now/CVE-2025-7051.md): N-central Syslog Configuration Insecure Direct Object Reference (CVSS 8.3)
- [CVE-2025-8875](https://cve.now/CVE-2025-8875.md): Insecure Deserialization Vulnerability (CVSS 9.4, KEV)
- [CVE-2025-8876](https://cve.now/CVE-2025-8876.md): Command Injection Vulnerability (CVSS 9.4, KEV)
- [CVE-2024-8510](https://cve.now/CVE-2024-8510.md): N-central Path Traversal (CVSS 5.3)
- [CVE-2024-5445](https://cve.now/CVE-2024-5445.md): Ecosystem Agent Insufficient Transport Layer Security (CVSS 3.8)
- [CVE-2024-28200](https://cve.now/CVE-2024-28200.md): N-central Authentication Bypass (CVSS 9.1)
- [CVE-2024-5322](https://cve.now/CVE-2024-5322.md): N-central Authentication Bypass via Session Rebinding (CVSS 9.1)
- [CVE-2023-37244](https://cve.now/CVE-2023-37244.md): Privilege escalation in N-Able's AutomationManagerAgent (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/n-able
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.