Product · KEV exposure
N-able N-central known exploited vulnerabilities
We track 5 CVEs in N-able N-central. All of them are on CISA's Known Exploited Vulnerabilities catalog, meaning CISA has evidence of exploitation in the wild (listed 2025–2026). The most recent is CVE-2026-86218, added to KEV on .
- CVEs tracked
- 5
- On CISA KEV
- 5
- Ransomware use
- 0
- Rated critical
- 1
Every N-able N-central CVE we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-86218 N-central Pre-Authentication Remote Code Executionwrite-up | [ CRITICAL ] | 10.0 | 13.3% | ||
| CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | [ HIGH ] | 7.4 | 7.9% | ||
| CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | [ HIGH ] | — | 14.6% | ||
| CVE-2025-8876 N-able N-Central Command Injection Vulnerability | [ HIGH ] | 8.8 | 3.4% | ||
| CVE-2025-8875 N-able N-Central Insecure Deserialization Vulnerability | [ HIGH ] | 7.8 | 1.9% |
Sorted by date added to KEV. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else. Machine-readable: /api/v1/vendors/n-able.json.
Our N-able N-central coverage
Every row links to its CVE record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker or compare KEV catalogs.