N-able vendor intelligence
N-able Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting N-able products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 8
- Known exploited vulnerabilities affecting N-able products
- In CISA KEV
- 5
- Records also listed in the official catalog
- Beyond CISA KEV
- 3
- Additional exploited vulnerabilities absent from CISA KEV
- Sensor Observed
- 3
- N-able KEVs with sensor-observed exploitation activity
The catalog gap matters for N-able exposure
Three of the eight exploited N-able vulnerabilities tracked by Previdian are not in CISA KEV. Teams relying on the official catalog alone would miss 37% of this vendor portfolio.
- 63%
- Covered by CISA
- 37%
- Beyond CISA
- 1
- Product families
Attested N-able vulnerabilities
8 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2026-86206
Access control filter bypass allows unauthorised access to APIs |
N-central | Confirmed | Beyond CISA | 10 Sep 2026 |
|
CVE-2026-86207
Authentication bypass leads to unauthorised access to N-central |
N-central | Confirmed | Beyond CISA | 09 Sep 2026 |
|
CVE-2026-86218
pre-authentication remote code execution |
N-central | Confirmed | In CISA | 06 Sep 2026 |
|
CVE-2026-18577
Incomplete patch leads to administrative account takeover |
N-central | Confirmed | In CISA | 03 Aug 2026 |
|
CVE-2026-18556
Unauthenticated administrative account takeover |
N-central | Confirmed | In CISA | 01 Aug 2026 |
|
CVE-2025-9316
N-central unauthenticated sessionID generation |
N-central | High | Beyond CISA | 03 Jun 2026 |
|
CVE-2025-8876
Command Injection Vulnerability |
N-central | Confirmed | In CISA | 01 Jun 2026 |
|
CVE-2025-8875
Insecure Deserialization Vulnerability |
N-central | Confirmed | In CISA | 01 Jun 2026 |
No N-able vulnerabilities match this search or filter.
Showing 8 of 8 on this page (8 N-able known exploited vulnerabilities).
Recurring weakness patterns
Authentication bypass using an alternate path or channel, input validation, and validation account for four mapped occurrences across this N-able KEV portfolio.
CWE-288
Authentication Bypass Using an Alternate Path or Channel
CWE-20
Improper Input Validation
CWE-1284
Improper Validation of Specified Quantity in Input
CWE-502
Deserialization of Untrusted Data
CWE-791
Incomplete Filtering of Special Elements
CWE-96
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
CWE-305
Authentication Bypass by Primary Weakness