N-Able

Products

Exploited and recent CVEs

• CVE-2026-86218 Critical 10.0 Exploited pre-authentication remote code execution 15.4%
• CVE-2026-18577 High 8.2 Exploited Incomplete patch leads to administrative account takeover 14.6%
• CVE-2026-18556 High 8.2 Exploited Unauthenticated administrative account takeover 7.9%
• CVE-2025-8875 Critical 9.4 Exploited Insecure Deserialization Vulnerability 2.3%
• CVE-2025-8876 Critical 9.4 Exploited Command Injection Vulnerability 4.1%
• CVE-2025-68624 Medium 4.3 N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. Whe 0.3%
• CVE-2026-86206 Medium 6.9 Access control filter bypass allows unauthorised access to APIs 1.1%
• CVE-2026-86207 High 7.7 Authentication bypass leads to unauthorised access to N-central 1.3%
• CVE-2026-15580 Medium 6.9 PassPortal browser extension: vault token disclosure via unvalidated postMessage 0.2%
• CVE-2025-11367 Critical 10.0 N-central windows software probe Remote Code Execution 0.6%
• CVE-2025-11366 Critical 9.4 N-central Authentication bypass via path traversal 0.6%
• CVE-2025-11700 High 8.4 N-central Multiple XXE Injection Vulnerabilities 31.7%
• CVE-2025-9316 Medium 6.9 N-central unauthenticated sessionID generation 37.4%
• CVE-2025-10231 High 7.0 N-central Incorrect Default Permissions could lead to Privilege Escalation 0.1%
• CVE-2025-7051 High 8.3 N-central Syslog Configuration Insecure Direct Object Reference 0.3%
• CVE-2024-8510 Medium 5.3 N-central Path Traversal 0.4%
• CVE-2024-5445 Low 3.8 Ecosystem Agent Insufficient Transport Layer Security 0.3%
• CVE-2024-28200 Critical 9.1 N-central Authentication Bypass 1.9%
• CVE-2024-5322 Critical 9.1 N-central Authentication Bypass via Session Rebinding 0.4%
• CVE-2023-37244 Medium 5.3 Privilege escalation in N-Able's AutomationManagerAgent 0.2%