12 CVEs matched to N-able by name in NVD, 3 on CISA's Known Exploited list.
Back to the N-able profile · Alternatives to N-able · CVE RSS feed
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through …
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
| Year | Critical | High | Medium | Low | Unscored | Total |
|---|---|---|---|---|---|---|
| 2026 | 0 | 1 | 1 | 0 | 1 | 3 |
| 2025 | 0 | 2 | 0 | 0 | 0 | 2 |
| 2024 | 2 | 1 | 0 | 1 | 0 | 4 |
| 2023 | 0 | 2 | 0 | 0 | 0 | 2 |
| 2015 | 0 | 0 | 1 | 0 | 0 | 1 |
3 of 12 matched CVEs are listed. 3 are past the remediation due date CISA set.
Most recent additions
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.
| CVE | EPSS | Percentile |
|---|---|---|
| CVE-2026-18556 | 7.9% | 95% |
| CVE-2025-8876 | 3.4% | 89% |
| CVE-2015-5610 | 2.4% | 84% |
| CVE-2024-28200 | 1.9% | 80% |
| CVE-2025-8875 | 1.9% | 79% |
| CVE-2023-47132 | 0.6% | 45% |
| CVE-2023-27470 | 0.5% | 43% |
| CVE-2023-47131 | 0.5% | 41% |
| CVE-2025-68624 | 0.3% | 25% |
| CVE-2024-5445 | 0.3% | 21% |
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. Whe…
vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.
Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installat…
The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 202…
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and…
The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered …
An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls.
The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file.
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates, leading t…
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server.
The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it easier for remote a…