N-Able vulnerabilities

CVEs per yearBy the year they were published

1. 20244
2. 20259
3. 20267

Known exploitedNewest addition to KEV first

• CVE-2026-86218

  pre-authentication remote code execution

  N-able · N-central

  ExploitedCritical10.0
• CVE-2026-18556

  Unauthenticated administrative account takeover

  N-able · N-central

  ExploitedHigh8.2
• CVE-2026-18577

  Incomplete patch leads to administrative account takeover

  N-able · N-central

  ExploitedHigh8.2
• CVE-2025-8875

  Insecure Deserialization Vulnerability

  N-able · N-central

  ExploitedCritical9.4
• CVE-2025-8876

  Command Injection Vulnerability

  N-able · N-central

  ExploitedCritical9.4

Newest CVEs

• CVE-2025-68624

  N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM…

  N-able · Mail Assure

  Medium4.3
• CVE-2026-86218

  pre-authentication remote code execution

  N-able · N-central

  ExploitedCritical10.0
• CVE-2026-86206

  Access control filter bypass allows unauthorised access to APIs

  N-able · N-central

  Medium6.9
• CVE-2026-86207

  Authentication bypass leads to unauthorised access to N-central

  N-able · N-central

  High7.7
• CVE-2026-15580

  PassPortal browser extension: vault token disclosure via unvalidated postMessage

  N-able · PassPortal

  Medium6.9
• CVE-2026-18577

  Incomplete patch leads to administrative account takeover

  N-able · N-central

  ExploitedHigh8.2
• CVE-2026-18556

  Unauthenticated administrative account takeover

  N-able · N-central

  ExploitedHigh8.2
• CVE-2025-11367

  N-central windows software probe Remote Code Execution

  N-able · N-central

  Critical10.0
• CVE-2025-11366

  N-central Authentication bypass via path traversal

  N-able · N-central

  Critical9.4
• CVE-2025-11700

  N-central Multiple XXE Injection Vulnerabilities

  N-able · N-central

  High8.4