N-able vulnerabilities
We track 16 vulnerabilities in N-able products across 5 products. 16 are rated high or critical, and 5 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest N-able vulnerabilities
- 8.4 High severity
N-central: Missing Authentication for Critical Functionality
Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 2026.4.1.
- 7.5 High severity
N-central: Download of Code Without Integrity Check
Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central: through 24.6.1.
- 9.3 Critical severity
N-central: Improper Restriction of XML External Entity Reference
Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1.
- 8.3 High severity
N-central: Improper Neutralization of HTTP Headers for Scripting Syntax
Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). This issue affects N-central: before 26.4.1.
- 8.7 High severity
N-central: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1.
- 9.8 Critical severity
N-able N-central Static Code Injection Exploited
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
- 8.1 High severity
N-able N-central Authentication Bypass Using an Alternate Path or Channel Exploited
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
- 7.4 High severity
N-able N-central Authentication Bypass Using an Alternate Path or Channel Exploited
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.
- 7.8 High severity
N-central: Incorrect Default Permissions
An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions.
- 8.3 High severity
N-central: Improper Access Control
On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.
- 8.8 High severity
N-able N-Central Command Injection Exploited
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
- 7.8 High severity
N-able N-Central Insecure Deserialization Exploited
Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
- 9.1 Critical severity
N-central: Authentication Bypass Using an Alternate Path or Channel
The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. This vulnerability is present in all Entra-supported deployments of N-central prior to 2024.3.
- 9.8 Critical severity
N-central: Improper Authentication
The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered through internal N-central source code review and N-able has
- 7.0 High severity
AutomationManagerAgent: Concurrent Execution using Shared Resource with Improper Synchronization
The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp, which could be leveraged by an attack
- 7.0 High severity
take_control: Time-of-check Time-of-use (TOCTOU) Race Condition
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates, leading to arbitrary file deletion.