N-Able: >> N-Central >> 2025.1 Security Vulnerabilities
CVE-2026-18577
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
Known exploited
CVSS Score
8.2
EPSS Score
0.025
Published
2026-08-02
CVE-2026-18556
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
This issue affects N-central: through 2026.1.
Known exploited
CVSS Score
8.2
EPSS Score
0.005
Published
2026-08-01
N-central < 2025.4 is vulnerable to authentication bypass via path traversal
CVSS Score
9.4
EPSS Score
0.006
Published
2025-11-12
The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization
CVSS Score
10.0
EPSS Score
0.006
Published
2025-11-12
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
CVSS Score
8.4
EPSS Score
0.307
Published
2025-11-12
An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions.
CVSS Score
7.0
EPSS Score
0.001
Published
2025-09-10
On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.
CVSS Score
8.3
EPSS Score
0.003
Published
2025-08-21
CVE-2025-8875
Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
Known exploited
CVSS Score
9.4
EPSS Score
0.016
Published
2025-08-14
CVE-2025-8876
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
Known exploited
CVSS Score
9.4
EPSS Score
0.031
Published
2025-08-14