Known exploited vulnerabilities
N-able vulnerabilities attackers have used
Every N-able vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.
The short answer
CISA lists 5 N-able vulnerabilities as exploited in the wild, 3 of them added in the last 12 months. The most recent is CVE-2026-86218, added Sep 8, 2026. N-central has the most entries (3).
- In KEV, all time
- 5
- Added, last 12 months
- 3
- Used in ransomware
- 0
- New CVEs this week
- 0
By product
N-central (3), N-Central (2).
Every N-able entry in CISA KEV
CVE-2026-86218
Added · dueN-able N-central Static Code Injection Vulnerability
N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.
CVE-2026-18556
Added · dueN-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.
CVE-2026-18577
Added · dueN-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.
CVE-2025-8876
Added · dueN-able N-Central Command Injection Vulnerability
N-able N-Central contains a command injection vulnerability via improper sanitization of user input.
CVE-2025-8875
Added · dueN-able N-Central Insecure Deserialization Vulnerability
N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.