Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 25

Export CSV
CVE-2026-125883

Multiple XXE Vulnerabilities

Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2026-91000

Insecure IPC Channels lead to local privilege escalation

Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 2026.4.1.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2026-125958

Root RCE via unsigned NSP upgrade package upload

Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central: through 24.6.1.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2026-125878

Multiple OGNL Injection vulnerabilities

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2026-125879

Local privilege escalation to root via nable-writable syslog-ng config

Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 26.4.1.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2026-125881

Schema-hint SSRF via service import schema validation

Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue affects N-central: before 26.4.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2026-125882

RCE via file repository upload path traversal

Relative path traversal vulnerability in N-able N-central allows Path Traversal. This issue affects N-central: before 26.4.1.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2026-86218

pre-authentication remote code execution

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

CVSS 4.0 · 10 Critical EPSS 15.4% KEV · Listed
Vendors
N-able
Products
N-central
CVE-2026-86207

Authentication bypass leads to unauthorised access to N-central

An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs

CVSS 4.0 · 7.7 High EPSS 1.3% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2026-86206

Access control filter bypass allows unauthorised access to APIs

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4

CVSS 4.0 · 6.9 Medium EPSS 1.1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2026-18556

Unauthenticated administrative account takeover

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

CVSS 4.0 · 8.2 High EPSS 43.9% KEV · Listed
Vendors
N-able
Products
N-central
CVE-2026-18577

Incomplete patch leads to administrative account takeover

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

CVSS 4.0 · 8.2 High EPSS 14.6% KEV · Listed
Vendors
N-able
Products
N-central
CVE-2025-9316

N-central unauthenticated sessionID generation

N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.

CVSS 4.0 · 6.9 Medium EPSS 37.4% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2025-10231

N-central Incorrect Default Permissions could lead to Privilege Escalation

An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft N-able
Products
Windows N-central
CVE-2025-7051

N-central Syslog Configuration Insecure Direct Object Reference

On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2025-11367

N-central windows software probe Remote Code Execution

The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2025-11700

N-central Multiple XXE Injection Vulnerabilities

N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure

CVSS 4.0 · 8.4 High EPSS 31.7% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2025-11366

N-central Authentication bypass via path traversal

N-central < 2025.4 is vulnerable to authentication bypass via path traversal

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
N-able
Products
N-central
CVE-2025-8875

Insecure Deserialization Vulnerability

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

CVSS 4.0 · 9.4 Critical EPSS 2.3% KEV · Listed
Vendors
N-able
Products
N-central
CVE-2025-8876

Command Injection Vulnerability

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

CVSS 4.0 · 9.4 Critical EPSS 4.1% KEV · Listed
Vendors
N-able
Products
N-central