N-able vulnerabilities

CVE-2025-68624 Medium · 4.3 CWE-290 Sep 13, 2026

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an...

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.

CVE-2026-86218 Critical · 9.8 KEV Urgent · 82 Public exploit CWE-96 Sep 6, 2026

N-able N-central Static Code Injection Vulnerability

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

CVE-2026-15580 Medium · 6.9 CWE-1385 Aug 21, 2026

PassPortal browser extension: vault token disclosure via unvalidated postMessage

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.

CVE-2026-18577 High · 8.1 KEV High · 68 Public exploit CWE-288 Aug 2, 2026

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

CVE-2026-18556 High · 7.4 KEV High · 64 Public exploit CWE-288 Aug 1, 2026

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

CVE-2025-9316 Medium · 6.9 Public exploit CWE-1284 Nov 12, 2025

N-central unauthenticated sessionID generation

N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.

CVE-2025-11700 High · 7.5 Public exploit CWE-611 Nov 12, 2025

N-central Multiple XXE Injection Vulnerabilities

N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure

CVE-2025-11367 Critical · 9.8 CWE-502 Nov 12, 2025

N-central windows software probe Remote Code Execution

The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization

CVE-2025-11366 Critical · 9.8 CWE-22 Nov 12, 2025

N-central Authentication bypass via path traversal

N-central < 2025.4 is vulnerable to authentication bypass via path traversal

CVE-2025-8875 High · 7.8 KEV High · 59 Public exploit CWE-502 Aug 14, 2025

N-able N-Central Insecure Deserialization Vulnerability

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

CVE-2025-8876 High · 8.8 KEV High · 54 CWE-78 Aug 14, 2025

N-able N-Central Command Injection Vulnerability

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.