PatchTheCVEn-able vulnerabilities
Recent CVEs affecting n-able products. 6 tracked.
n-able has 6 tracked vulnerabilities, 3 critical and 3 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 6. Most recent: 2026-09-06. Highest priority: CVE-2026-86218 (score 96/100).
- CVE-2026-18577 HIGH 8.1 EXPLOITED UPGRADE N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-18556 HIGH 7.4 EXPLOITED UPGRADE N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2025-11700 HIGH 7.5 UPGRADE N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information
- CVE-2025-11367 CRITICAL 9.8 UPGRADE The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization
- CVE-2025-11366 CRITICAL 9.8 UPGRADE N-central < 2025.4 is vulnerable to authentication bypass via path traversal
- CVE-2026-86218 CRITICAL 9.8 EXPLOITED UPGRADE N-able N-central Static Code Injection Vulnerability
FAQ
How do I fix n-able vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is n-able being exploited right now?
Yes: 3 n-able CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.
Which n-able CVE should I patch first?
CVE-2026-86218 currently ranks highest (96/100): N-able N-central Static Code Injection Vulnerability.