Threat database

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

CVE-2026-86206 is a medium severity vulnerability in N-able N-central that involves incomplete filtering of special elements in the internal API access control filter. This flaw allows unauthorized access to internal APIs. The issue is addressed in versions 2026.3 HF3 and 2026.4 of N-central.

CVE-2026-86207 is a high-severity authentication bypass vulnerability in N-able N-central versions prior to 2026.3.1.13. The flaw allows bypassing authentication in internal-only APIs due to a primary weakness classified as CWE-305. This vulnerability could enable unauthorized access to internal API functions.

CVE-2026-15580 is a vulnerability in the N-able PassPortal browser extension prior to version 3.49.6. It involves missing origin validation in WebSockets, leading to vault token disclosure through an unvalidated postMessage mechanism. This flaw can allow authentication abuse by exposing sensitive tokens.

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization

EPSS 0.6%VulnerabilityN-able#cwe-502United States+9

N-central < 2025.4 is vulnerable to authentication bypass via path traversal

EPSS 0.6%VulnerabilityN-able#cwe-22Germany+5

N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure

EPSS 31%VulnerabilityN-able#cwe-611Germany+6

N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.

EPSS 37%VulnerabilityN-able#cwe-1284Germany+7

An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions.

EPSS 0.1%VulnerabilityN-able#cwe-276United States+9

On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.

EPSS 0.3%VulnerabilityN-able#cwe-284United States+9

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

KEVEPSS 1.9%VulnerabilityN-able#cwe-502United States+9

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

KEVEPSS 3.4%VulnerabilityN-able#cwe-20United States+11