7
CVEs
1
Critical
3
High
3
KEV
5
PoC
2
Unpatched C/H
57.1%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
3
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (6)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86218 | Pre-authentication remote code execution in N-able N-central before 2026.3.1.14 allows unauthenticated remote attackers to execute arbitrary code on the management server, per the vendor's own security advisory. Rated CVSS 4.0 10.0 with a full-impact vector including scope change, it targets a platform that centrally manages large fleets of downstream endpoints, making it an exceptionally high-value target. No public exploit has been identified at time of analysis, and it is not yet listed in CISA KEV, but the pre-auth, network-reachable nature warrants emergency patching. | CRITICAL | 10.0 | 0.4% | 120 |
KEV
PoC
|
| CVE-2026-18577 | Authentication bypass and account takeover in N-able N-central through version 2026.3.1 stem from an incomplete remediation of CVE-2026-18556, leaving an alternate authentication path exploitable by unauthenticated remote attackers. The vendor's CVSS 4.0 submission includes E:A (Attacked), indicating active exploitation is occurring against this incomplete patch. Despite high attack complexity (AC:H), the absence of privilege requirements and the high-value nature of RMM platforms - which provide lateral movement to thousands of managed endpoints - makes this a critical priority for MSP operators. | HIGH | 8.2 | 1.5% | 117 |
KEV
PoC
No patch
|
| CVE-2026-18556 | Authentication bypass in N-able N-central through version 2026.1 allows unauthenticated remote attackers to circumvent authentication controls via an alternate path or channel (CWE-288), resulting in high confidentiality impact against the vulnerable system. The CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N/VC:H) indicates exploitation requires elevated attack complexity but no credentials, suggesting a non-trivial bypass technique such as direct access to an unauthenticated API endpoint or alternate URL path that bypasses the primary authentication gateway. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 8.2 | 0.3% | 116 |
KEV
PoC
No patch
|
| CVE-2026-86207 | Authentication bypass in N-able N-central before version 2026.3 HF 3 permits low-privileged authenticated users to access internal-only APIs without proper authorization checks, achieving effective privilege escalation within the platform. N-central is a remote monitoring and management (RMM) platform used extensively by managed service providers (MSPs) to control customer endpoints, meaning unauthorized API access could cascade to managed devices across multiple customer environments. No public exploit has been identified at time of analysis, but a vendor patch has been released as HF 3. | HIGH | 7.7 | 0.3% | 59 |
PoC
|
| CVE-2026-86206 | Unauthenticated remote access to restricted internal APIs is possible in N-able N-central due to an incomplete access control filter, classified under CWE-791. All N-central deployments prior to versions 2026.3 HF3 and 2026.4 are affected, as confirmed by the vendor advisory. Impact is limited to partial information disclosure (CVSS 4.0 VC:L) with no integrity or availability effects reported; no public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 6.9 | 0.3% | 55 |
PoC
|
| CVE-2026-15580 | Vault token disclosure in the N-able PassPortal browser extension (versions before 3.49.6) stems from missing origin validation on postMessage events, classified under CWE-1385. A malicious web page can send a crafted postMessage to the extension listener, causing it to disclose HashiCorp Vault tokens to an untrusted origin - enabling authentication abuse against any Vault instance the user's session is authorized to access. No public exploit code has been identified at time of analysis, but the network-accessible, unauthenticated attack path (UI:A in CVSS 4.0) and high confidentiality impact make this a meaningful credential theft risk for MSP environments. | MEDIUM | 6.9 | 0.2% | 35 |
|
| CVE-2025-68624 | Cross-tenant SMTP sender spoofing in N-able Mail Assure (all versions through April 2026) permits any authenticated tenant to specify arbitrary MAIL FROM envelope addresses - including domains belonging to other co-hosted tenants - without the relay enforcing any domain-to-account ownership binding. Because the shared relay is itself listed in the SPF records and DMARC policy of every hosted tenant domain, spoofed outbound messages pass SPF and DMARC validation at recipient mail servers, giving the attack the appearance of fully authorized email. N-able has publicly stated this is intended behavior of its shared relay architecture, making no vendor patch expected. A researcher demonstration gist has been published, and no public exploit or CISA KEV listing exists at time of analysis. | MEDIUM | 4.3 | 0.3% | 22 |
No patch
|