N-able
N-able N-central: vulnerabilidades y CVE
N-able N-central tiene 17 vulnerabilidades publicadas, 8 de ellas en los últimos 12 meses. 8 son críticas y 5 figuran en el catálogo de explotación activa de CISA.
CVE17
Últimos 12 meses8
Críticas8
Explotadas activamente5
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-86218 | Crítica (10) | 13% | ⚠ Explotación activa | 6 sept 2026 | N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. |
| CVE-2026-18556 | Alta (8.2) | 7.9% | ⚠ Explotación activa | 1 ago 2026 | Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1. |
| CVE-2026-18577 | Alta (8.2) | 15% | ⚠ Explotación activa | 2 ago 2026 | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 |
| CVE-2025-8876 | Crítica (9.4) | 3.4% | ⚠ Explotación activa | 14 ago 2025 | Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. |
| CVE-2025-8875 | Crítica (9.4) | 1.9% | ⚠ Explotación activa | 14 ago 2025 | Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1. |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-86218 | Crítica (10) | 13% | ⚠ Explotación activa | 6 sept 2026 | N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. |
| CVE-2026-86207 | Alta (7.7) | 1.3% | — | 5 sept 2026 | An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs |
| CVE-2026-18577 | Alta (8.2) | 15% | ⚠ Explotación activa | 2 ago 2026 | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 |
| CVE-2026-18556 | Alta (8.2) | 7.9% | ⚠ Explotación activa | 1 ago 2026 | Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1. |
| CVE-2025-9316 | Media (6.9) | 36% | — | 12 nov 2025 | N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4. |
| CVE-2025-11700 | Alta (8.4) | 31% | — | 12 nov 2025 | N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure |
| CVE-2025-11367 | Crítica (10) | 0.58% | — | 12 nov 2025 | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization |
| CVE-2025-11366 | Crítica (9.4) | 0.56% | — | 12 nov 2025 | N-central < 2025.4 is vulnerable to authentication bypass via path traversal |
| CVE-2025-10231 | Alta (7.8) | 0.13% | — | 10 sept 2025 | An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions. |
| CVE-2025-7051 | Alta (8.3) | 0.28% | — | 21 ago 2025 | On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to… |
| CVE-2025-8876 | Crítica (9.4) | 3.4% | ⚠ Explotación activa | 14 ago 2025 | Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. |
| CVE-2025-8875 | Crítica (9.4) | 1.9% | ⚠ Explotación activa | 14 ago 2025 | Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1. |
| CVE-2024-8510 | Media (5.3) | 0.40% | — | 17 mar 2025 | N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerability is present in all deployments of N-central prior to… |
| CVE-2024-5322 | Crítica (9.1) | 0.41% | — | 1 jul 2024 | The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. This vulnerability is present in all Entra-supported deployments of… |
| CVE-2024-28200 | Crítica (9.8) | 1.9% | — | 1 jul 2024 | The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered through internal… |
| CVE-2023-47132 | Crítica (9.8) | 0.55% | — | 8 feb 2024 | An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls. |
| CVE-2023-30297 | Alta (7) | 0.18% | — | 4 ago 2023 | An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.