CVE-2026-18577 | High | 8.1 | 2026-08-02 | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 |
CVE-2026-18556 | High | 7.4 | 2026-08-01 | Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
This issue affects N-central: through… |
CVE-2025-9316 | | | 2025-11-12 | N-central < 2025.4 can generate sessionIDs for unauthenticated users
This issue affects N-central: before 2025.4. |
CVE-2025-11700 | High | 7.5 | 2025-11-12 | N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure |
CVE-2025-11367 | Critical | 9.8 | 2025-11-12 | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization |
CVE-2025-11366 | Critical | 9.8 | 2025-11-12 | N-central < 2025.4 is vulnerable to authentication bypass via path traversal |
CVE-2025-10231 | High | 7.0 | 2025-09-10 | An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to… |
CVE-2025-7051 | High | 8.3 | 2025-08-21 | On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerabil… |
CVE-2025-8876 | High | 8.8 | 2025-08-14 | Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. |
CVE-2025-8875 | High | 7.8 | 2025-08-14 | Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1. |
CVE-2024-8510 | Medium | 5.3 | 2025-03-17 | N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed.
This vulnerab… |
CVE-2024-5445 | Low | 3.8 | 2024-08-12 | Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious… |
CVE-2024-5322 | Critical | 9.1 | 2024-07-01 | The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass.
This vu… |
CVE-2024-28200 | Critical | 9.1 | 2024-07-01 | The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 20… |
CVE-2023-37244 | Medium | 5.3 | 2024-05-02 | The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlin… |
CVE-2023-47132 | Critical | 9.8 | 2024-02-08 | An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls. |
CVE-2023-47131 | High | 7.5 | 2024-02-08 | The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file. |
CVE-2023-27470 | High | 7.0 | 2023-09-11 | BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSuppor… |
CVE-2023-30297 | High | 7.0 | 2023-08-04 | An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the serve… |