pwn.watch: N-able incident updates

[high] N-able N-central: N-able N-central Static Code Injection Vulnerability

Tue, 08 Sep 2026 00:00:00 GMT

N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. Added to CISA KEV on 2026-09-08.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-08: CISA added CVE-2026-86218 to the KEV catalog (due 2026-09-11).

CVEs: CVE-2026-86218

[high] N-able N-central: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Tue, 04 Aug 2026 00:00:00 GMT

N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556. CISA added CVE-2026-18577, CVE-2026-18556 to the Known Exploited Vulnerabilities catalog on 2026-08-03 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-03: CISA added CVE-2026-18577, CVE-2026-18556 to the KEV catalog (due 2026-08-06).

CVEs: CVE-2026-18577, CVE-2026-18556

[critical] N-able N-Central: 2 exploited vulnerabilities (CVE-2025-8875, CVE-2025-8876)

Wed, 13 Aug 2025 00:00:00 GMT

CVE-2025-8875: N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution. CVE-2025-8876: N-able N-Central contains a command injection vulnerability via improper sanitization of user input. Added to CISA KEV on 2025-08-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-08-13: CISA added CVE-2025-8875 to the KEV catalog (due 2025-08-20).
2025-08-13: CISA added CVE-2025-8876 to the KEV catalog (due 2025-08-20).

CVEs: CVE-2025-8875, CVE-2025-8876