{"meta":{"title":"KEV entries: N-able","description":"All KEV entries for vendor N-able.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":5,"vendor":"N-able","entries":5,"shareOfCatalogPercent":0.3,"ransomwareKnown":0,"firstDateAdded":"2025-08-13","latestDateAdded":"2026-09-08","rank":48},"data":[{"cveID":"CVE-2026-86218","vendorProject":"N-able","product":"N-central","vulnerabilityName":"N-able N-central Static Code Injection Vulnerability","dateAdded":"2026-09-08","dueDate":"2026-09-11","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-96"],"shortDescription":"N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/ ; https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86218","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-86218/"},{"cveID":"CVE-2026-18556","vendorProject":"N-able","product":"N-central","vulnerabilityName":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","dateAdded":"2026-08-04","dueDate":"2026-08-07","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-288"],"shortDescription":"N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://uptime.n-able.com/ ; https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-18556","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-18556/"},{"cveID":"CVE-2026-18577","vendorProject":"N-able","product":"N-central","vulnerabilityName":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","dateAdded":"2026-08-03","dueDate":"2026-08-06","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-288"],"shortDescription":"N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm ; https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-18577","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-18577/"},{"cveID":"CVE-2025-8876","vendorProject":"N-able","product":"N-Central","vulnerabilityName":"N-able N-Central Command Injection Vulnerability","dateAdded":"2025-08-13","dueDate":"2025-08-20","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"N-able N-Central contains a command injection vulnerability via improper sanitization of user input.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-8876","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-8876"},{"cveID":"CVE-2025-8875","vendorProject":"N-able","product":"N-Central","vulnerabilityName":"N-able N-Central Insecure Deserialization Vulnerability","dateAdded":"2025-08-13","dueDate":"2025-08-20","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-8875","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-8875"}]}