📦

n-central

Vendor: n-able

Login to add this product to WatchStack
Actively Exploited 4 CISA KEV List
PoC / Exploits 5 Code Available
Total RCEs 5 Remote Access
Total CVEs 25 Total Indexed
Avg. EPSS 2.76% Exploit Prob.
Latest CVE CVE-2026-18577 Aug 02

Security Vulnerability Index

Page 1 / 3
8.2 CVSS
CVE-2026-18577
Exploit Found

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

EPSS: 4.10%
8.2 CVSS
CVE-2026-18556
Exploit Found

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

EPSS: 0.49%
8.4 CVSS
CVE-2025-11700
Exploit Found

N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure

EPSS: 30.70%
10.0 CVSS
CVE-2025-11367
RCE

The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization

EPSS: 0.58%
9.4 CVSS
CVE-2025-11366

N-central < 2025.4 is vulnerable to authentication bypass via path traversal

EPSS: 0.56%
7.0 CVSS
CVE-2025-10231

An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions.

EPSS: 0.12%
8.3 CVSS
CVE-2025-7051

On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.

EPSS: 0.27%
9.4 CVSS
CVE-2025-8876
RCE Exploit Found

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

EPSS: 3.09%
9.4 CVSS
CVE-2025-8875
RCE Exploit Found

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

EPSS: 1.59%
5.3 CVSS
CVE-2024-8510

N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerability is present in all deployments of N-central prior to N-central 2024.6.

EPSS: 0.37%