N Able
Monthly
Pre-authentication remote code execution in N-able N-central before 2026.3.1.14 allows unauthenticated remote attackers to execute arbitrary code on the management server, per the vendor's own security advisory. Rated CVSS 4.0 10.0 with a full-impact vector including scope change, it targets a platform that centrally manages large fleets of downstream endpoints, making it an exceptionally high-value target. No public exploit has been identified at time of analysis, and it is not yet listed in CISA KEV, but the pre-auth, network-reachable nature warrants emergency patching.
Authentication bypass in N-able N-central before version 2026.3 HF 3 permits low-privileged authenticated users to access internal-only APIs without proper authorization checks, achieving effective privilege escalation within the platform. N-central is a remote monitoring and management (RMM) platform used extensively by managed service providers (MSPs) to control customer endpoints, meaning unauthorized API access could cascade to managed devices across multiple customer environments. No public exploit has been identified at time of analysis, but a vendor patch has been released as HF 3.
Authentication bypass and account takeover in N-able N-central through version 2026.3.1 stem from an incomplete remediation of CVE-2026-18556, leaving an alternate authentication path exploitable by unauthenticated remote attackers. The vendor's CVSS 4.0 submission includes E:A (Attacked), indicating active exploitation is occurring against this incomplete patch. Despite high attack complexity (AC:H), the absence of privilege requirements and the high-value nature of RMM platforms - which provide lateral movement to thousands of managed endpoints - makes this a critical priority for MSP operators.
Authentication bypass in N-able N-central through version 2026.1 allows unauthenticated remote attackers to circumvent authentication controls via an alternate path or channel (CWE-288), resulting in high confidentiality impact against the vulnerable system. The CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N/VC:H) indicates exploitation requires elevated attack complexity but no credentials, suggesting a non-trivial bypass technique such as direct access to an unauthenticated API endpoint or alternate URL path that bypasses the primary authentication gateway. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
N-able N-central before 2025.3.1 contains an OS command injection through improper input validation, companion vulnerability to CVE-2025-8875.
N-able N-central before 2025.3.1 contains a deserialization vulnerability allowing local code execution through crafted serialized data.
Cross-tenant SMTP sender spoofing in N-able Mail Assure (all versions through April 2026) permits any authenticated tenant to specify arbitrary MAIL FROM envelope addresses - including domains belonging to other co-hosted tenants - without the relay enforcing any domain-to-account ownership binding. Because the shared relay is itself listed in the SPF records and DMARC policy of every hosted tenant domain, spoofed outbound messages pass SPF and DMARC validation at recipient mail servers, giving the attack the appearance of fully authorized email. N-able has publicly stated this is intended behavior of its shared relay architecture, making no vendor patch expected. A researcher demonstration gist has been published, and no public exploit or CISA KEV listing exists at time of analysis.
Unauthenticated remote access to restricted internal APIs is possible in N-able N-central due to an incomplete access control filter, classified under CWE-791. All N-central deployments prior to versions 2026.3 HF3 and 2026.4 are affected, as confirmed by the vendor advisory. Impact is limited to partial information disclosure (CVSS 4.0 VC:L) with no integrity or availability effects reported; no public exploit code or active exploitation has been identified at time of analysis.
Vault token disclosure in the N-able PassPortal browser extension (versions before 3.49.6) stems from missing origin validation on postMessage events, classified under CWE-1385. A malicious web page can send a crafted postMessage to the extension listener, causing it to disclose HashiCorp Vault tokens to an untrusted origin - enabling authentication abuse against any Vault instance the user's session is authorized to access. No public exploit code has been identified at time of analysis, but the network-accessible, unauthenticated attack path (UI:A in CVSS 4.0) and high confidentiality impact make this a meaningful credential theft risk for MSP environments.
N-able N-central remote monitoring and management platform versions before 2025.4 contain multiple XML External Entity injection vulnerabilities. Attackers can exploit these to read sensitive files from the RMM server, including configuration files containing credentials for all managed endpoints.
The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
N-central < 2025.4 is vulnerable to authentication bypass via path traversal. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions. Rated high severity (CVSS 7.0). No vendor patch available.
On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The N-central server is vulnerable to an authentication bypass of the user interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates, leading. Rated high severity (CVSS 7.0). Public exploit code available and no vendor patch available.
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server. Rated high severity (CVSS 7.0). No vendor patch available.
Pre-authentication remote code execution in N-able N-central before 2026.3.1.14 allows unauthenticated remote attackers to execute arbitrary code on the management server, per the vendor's own security advisory. Rated CVSS 4.0 10.0 with a full-impact vector including scope change, it targets a platform that centrally manages large fleets of downstream endpoints, making it an exceptionally high-value target. No public exploit has been identified at time of analysis, and it is not yet listed in CISA KEV, but the pre-auth, network-reachable nature warrants emergency patching.
Authentication bypass in N-able N-central before version 2026.3 HF 3 permits low-privileged authenticated users to access internal-only APIs without proper authorization checks, achieving effective privilege escalation within the platform. N-central is a remote monitoring and management (RMM) platform used extensively by managed service providers (MSPs) to control customer endpoints, meaning unauthorized API access could cascade to managed devices across multiple customer environments. No public exploit has been identified at time of analysis, but a vendor patch has been released as HF 3.
Authentication bypass and account takeover in N-able N-central through version 2026.3.1 stem from an incomplete remediation of CVE-2026-18556, leaving an alternate authentication path exploitable by unauthenticated remote attackers. The vendor's CVSS 4.0 submission includes E:A (Attacked), indicating active exploitation is occurring against this incomplete patch. Despite high attack complexity (AC:H), the absence of privilege requirements and the high-value nature of RMM platforms - which provide lateral movement to thousands of managed endpoints - makes this a critical priority for MSP operators.
Authentication bypass in N-able N-central through version 2026.1 allows unauthenticated remote attackers to circumvent authentication controls via an alternate path or channel (CWE-288), resulting in high confidentiality impact against the vulnerable system. The CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N/VC:H) indicates exploitation requires elevated attack complexity but no credentials, suggesting a non-trivial bypass technique such as direct access to an unauthenticated API endpoint or alternate URL path that bypasses the primary authentication gateway. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
N-able N-central before 2025.3.1 contains an OS command injection through improper input validation, companion vulnerability to CVE-2025-8875.
N-able N-central before 2025.3.1 contains a deserialization vulnerability allowing local code execution through crafted serialized data.
Cross-tenant SMTP sender spoofing in N-able Mail Assure (all versions through April 2026) permits any authenticated tenant to specify arbitrary MAIL FROM envelope addresses - including domains belonging to other co-hosted tenants - without the relay enforcing any domain-to-account ownership binding. Because the shared relay is itself listed in the SPF records and DMARC policy of every hosted tenant domain, spoofed outbound messages pass SPF and DMARC validation at recipient mail servers, giving the attack the appearance of fully authorized email. N-able has publicly stated this is intended behavior of its shared relay architecture, making no vendor patch expected. A researcher demonstration gist has been published, and no public exploit or CISA KEV listing exists at time of analysis.
Unauthenticated remote access to restricted internal APIs is possible in N-able N-central due to an incomplete access control filter, classified under CWE-791. All N-central deployments prior to versions 2026.3 HF3 and 2026.4 are affected, as confirmed by the vendor advisory. Impact is limited to partial information disclosure (CVSS 4.0 VC:L) with no integrity or availability effects reported; no public exploit code or active exploitation has been identified at time of analysis.
Vault token disclosure in the N-able PassPortal browser extension (versions before 3.49.6) stems from missing origin validation on postMessage events, classified under CWE-1385. A malicious web page can send a crafted postMessage to the extension listener, causing it to disclose HashiCorp Vault tokens to an untrusted origin - enabling authentication abuse against any Vault instance the user's session is authorized to access. No public exploit code has been identified at time of analysis, but the network-accessible, unauthenticated attack path (UI:A in CVSS 4.0) and high confidentiality impact make this a meaningful credential theft risk for MSP environments.
N-able N-central remote monitoring and management platform versions before 2025.4 contain multiple XML External Entity injection vulnerabilities. Attackers can exploit these to read sensitive files from the RMM server, including configuration files containing credentials for all managed endpoints.
The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
N-central < 2025.4 is vulnerable to authentication bypass via path traversal. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions. Rated high severity (CVSS 7.0). No vendor patch available.
On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The N-central server is vulnerable to an authentication bypass of the user interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates, leading. Rated high severity (CVSS 7.0). Public exploit code available and no vendor patch available.
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server. Rated high severity (CVSS 7.0). No vendor patch available.