N-able Vulnerabilities: 15 CVEs in 2026, 3 Exploited, and 5 N-central Hotfixes in 100 Days

N-able vulnerabilities, as of November 13, 2026: 44 CVEs across N-central, N-sight’s agent, Take Control, Passportal and other N-able and legacy SolarWinds MSP products, 15 of them published this year. CISA lists 5 as exploited, all in the N-central server. The newest fixed build is N-central 2026.4.1.26, and agents and probes must be upgraded too.

Key findings

• NVD and the CVE Program list 44 CVEs for N-able products and the SolarWinds MSP products N-able inherited. 36 of them (82%) are in N-central’s server, agent or probe.
• 2026 has 15 N-able CVEs to November 13, the most of any year; 13 hit N-central. The previous high was 11 in 2020, when the product still carried the SolarWinds name.
• All 5 N-able entries in CISA’s KEV catalog are N-central server flaws: 2 added August 13, 2025 and 3 between August 3 and September 8, 2026. None carries a Known ransomware flag.
• CISA listed every N-able KEV entry within 3 days of the CVE record, and twice before it: CVE-2025-8875 and 8876 entered KEV a day before their records went public.
• Federal deadlines for N-able flaws fell from 7 days in 2025 to 3 days in 2026. 157 of the 295 KEV entries added in 2026 carry a 3-day window.
• N-able shipped 5 N-central security builds in 100 days, from 2026.3.1.7 on August 2 to 2026.4.1.26 on November 10, and twice replaced a fix less than a week old (HF2 four days after HF1, HF4 one day after HF3).
• 11 of the 15 CVEs from 2026 still show Awaiting Analysis in NVD, so scanners that wait for NVD enrichment can miss them.

Check your N-central server build

N-central security builds in 2025 and 2026

The N-central builds that close the five KEV-listed CVEs and the other 2026 N-central records. Dates and quotes come from the N-able status page or release notes each CVE record or KEV entry points to, read one page at a time on November 13, 2026.

1. Aug 13, 2025
   N-central 2025.3.1 · N-central 2025.3.1 GA notice

   CVE-2025-8875, CVE-2025-8876. N-able: “You must upgrade your on-premises N-central to 2025.3.1.” Both flaws need authentication. CISA added both to KEV the same day, with a 7-day deadline.

2. Aug 2, 2026
   N-central 2026.3.1.7 (HF1) · 2026.3 Hotfix 1

   Fix for CVE-2026-18577, the only CVE on the page; CISA’s KEV entry for CVE-2026-18556 also points here. Hosted servers upgraded automatically. Indicators on the page: an svchost.exe in a user’s Documents folder, a service named Cloudflared, and four inbound IP addresses.

3. Aug 6, 2026
   N-central 2026.3.1.10 (HF2) · 2026.3 Hotfix 2

   Additional mitigation for CVE-2026-18577. “Hotfix 2 is required, even if you already applied the earlier hotfix.” N-able’s August 4 update says anyone who applied a hotfix “more than a few days after release” should treat the environment as potentially compromised.

4. Sep 5, 2026
   N-central 2026.3.1.13 (HF3) · 2026.3 Hotfix 3 release notes

   CVE-2026-86206, CVE-2026-86207, authentication bypasses credited in the CVE records to Michael Tigges of Huntress and Stephen Fewer of Rapid7. N-able: “no confirmations” of exploitation in production.

5. Sep 6, 2026
   N-central 2026.3.1.14 (HF4) · 2026.3 Hotfix 4

   CVE-2026-86218, pre-auth RCE scored 10.0 under CVSS 4.0 in N-able’s record. Supersedes HF3. N-able’s page said it had “no confirmations” of exploitation; CISA added it to KEV two days later.

6. Nov 10, 2026
   N-central 2026.4.1.26 (2026.4 HF2) · 2026.4 HF2 release notes

   CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, CVE-2026-125883, CVE-2026-91000. “Both hosted and on-premises customers need to upgrade their Agents and Probes.” Direct upgrade from 2025.4 or later only.

Hosted N-central (NCOD) servers were patched by N-able for each build. On-premises servers had to be upgraded by the MSP. Builds between these milestones are not listed.

The 2026 N-central sprint, day by day

From the first detection on July 31 to the November 10 hotfix, N-able published 13 N-central CVE records on 5 dates and shipped 5 security builds. CISA added three of those CVEs to KEV with 3-day federal deadlines. N-able’s August 4 update says its Adlumin MDR service spotted the first intrusion on July 31, and that attackers used the Take Control feature to reach managed devices and registered Cloudflare tunnel services that kept access after N-central access was revoked.

Figure 1. N-central CVEs, hotfixes and KEV listings, July 31 to November 13, 2026

Blue bars show how many CVE records went public that day (CVE Program datePublished). Diamonds are hotfix builds from N-able’s status pages. Red bars run from KEV dateAdded to dueDate. Amber points are third-party or vendor reports: N-able’s August 4 blog, Huntress (September 4) and Huntress (November 9 to 12).

Sophos’s Counter Threat Unit described one victim compromised around 08:00 UTC on August 3, 2026, where the attacker went from the N-central server to a backup server and domain controllers, created a domain account named “veeam”, and installed AnyDesk, TacticalRMM, TeamViewer, RustDesk, SimpleHelp and HopToDesk alongside Cloudflare Tunnel. That is the pattern MSPs fear most from an RMM compromise, and our analysis of RMM vulnerabilities in CISA KEV shows how RMM and IT management tools compare with VPN gateways and remote support software across the whole catalog.

N-able vulnerabilities in CISA KEV

Five N-able CVEs are in KEV as of catalog version 2026.11.10, all in the N-central server. CISA’s own descriptions call two of them authentication bypasses, one static code injection allowing pre-authentication RCE, one insecure deserialization and one command injection.

Figure 2. Days from CVE record to KEV listing, and the federal deadline that followed

Days: CVE-2025-8876 -1, CVE-2025-8875 -1, CVE-2026-18577 +1, CVE-2026-18556 +3, CVE-2026-86218 +2. The 2026 entries cite CISA’s BOD 26-04. Across the catalog, 157 of the 295 KEV additions in 2026 carry a 3-day window.

For CVE-2026-86218, N-able’s HF4 page said it had “no confirmations that this vulnerability has been exploited in production environments.” CISA added it to KEV on September 8, two days after the CVE record, which means CISA had evidence of exploitation. MSPs should read a vendor’s “no confirmations” as a statement about what the vendor has seen, not a clean bill of health.

N-able vulnerabilities by product

N-central carries the record: 36 of 44 CVEs. The rest are scattered across agents and add-ons, and Cove Data Protection has none on file under any of its names.

Figure 3. Every N-able CVE by product, 2015 to 2026

Hover a dot for the CVE, issue and score. Dots in the same month are grouped. The axis skips 2016 to 2018, which have no records. Products are as named in each CVE record; the Advanced Monitoring Agent is the device agent of N-sight RMM, per N-able’s N-sight documentation.

N-central vulnerability trend: more flaws, scored higher

Severity rose with volume. Using N-able’s own CVSS 4.0 scores where it files them and NVD’s scores for older records, 10 of the 44 CVEs rate 9.0 or higher, 10 of them in N-central. 2026 alone has 3 critical and 9 high. 4 of the 2026 N-central records describe an authentication bypass or account takeover, the class that gives an attacker the admin console without a password.

Figure 4. N-able CVEs per year by severity band

*2026 runs to November 13. Years with no CVEs (2016 to 2019, 2021, 2022) are omitted. N-able’s records use CVSS 4.0 from August 2025 and CVSS 3.1 before; the 2015 record has only a CVSS 2.0 score. Bands: 9.0+ critical, 7.0 to 8.9 high, 4.0 to 6.9 medium.

Every N-able CVE, with fixed build

Red rows are in CISA KEV. Issue text is our plain-language summary of the CVE record. CVE-2026-125958’s record says versions “through 24.6.1” are affected, which does not match N-central’s current year-based numbering; we report it as filed. CVE-2025-68624 is disputed: the record says N-able regards the behavior as intended in its shared SMTP service.

What this means for MSPs

Get every on-premises N-central server to 2026.4.1.26, then the agents and probes. The HF2 release notes require agent and probe upgrades for hosted and on-premises customers alike, because CVE-2026-91000 is a local privilege escalation through insecure IPC channels. Servers older than 2025.4 cannot jump straight to it.

Treat late patching as a possible breach. N-able’s own August 4 guidance says that if you applied either August hotfix “more than a few days after release”, you should treat the environment as potentially compromised and review all user accounts. With CISA listing N-central flaws within 3 days of disclosure, a patch window measured in weeks is too slow for this product.

Hunt for what the August attackers left behind. N-able’s published indicators were an svchost.exe in a user’s Documents folder, a service named Cloudflared, unusual Take Control sessions, unexpected users and unexplained password resets. Sophos found six other remote access tools on one victim. Disable the in-product support account unless a ticket needs it, as N-able recommends, and enforce MFA on every console login.

Do not expose the console unless you must. Of the 13 N-central CVEs in 2026, 4 are authentication bypasses or account takeovers and one is pre-authentication RCE. Restricting who can reach the N-central web console by IP allowlist or VPN cuts the number of attackers who can try them, and watch our CISA KEV analysis for how fast other vendors’ flaws are moving into the catalog.

Watch the November chains. Huntress’s November 12 update says a researcher published new chains on November 11 that worked against HF2, and that N-able issued guidance on the Legacy API setting. No CVE for them existed in NVD on November 13. Check N-able’s status page before assuming 2026.4.1.26 is the end of it, and see our ScreenConnect vulnerability ledger for how a rival remote tool’s flaws played out after public exploit code.

Frequently asked questions

What are the N-able vulnerabilities in 2026?

From January 1 to November 13, 2026, 15 CVEs were published for N-able products, more than in any earlier year. 13 affect N-central, one the Passportal browser extension (CVE-2026-15580) and one Mail Assure (CVE-2025-68624, disputed by N-able). Three of the N-central flaws, CVE-2026-18577, CVE-2026-18556 and CVE-2026-86218, are in CISA’s Known Exploited Vulnerabilities catalog.

Is there an N-central critical vulnerability right now?

Yes. N-able’s newest records, published November 10, 2026, cover 7 N-central flaws fixed in 2026.4 HF2 (build 2026.4.1.26), including CVE-2026-125881 and CVE-2026-125883 at CVSS 9.3. Huntress reported on November 12 that a researcher had published new exploit chains against HF2 late on November 11. As of November 13, NVD shows no N-able CVE newer than November 10.

Was N-central added to CISA KEV?

Yes, five times. CVE-2025-8875 and CVE-2025-8876 were added on August 13, 2025, CVE-2026-18577 on August 3, 2026, CVE-2026-18556 on August 4 and CVE-2026-86218 on September 8, 2026. CISA’s ransomware field reads Unknown for all five in catalog version 2026.11.10.

Which N-central build fixes all known CVEs?

Build 2026.4.1.26 (2026.4 HF2, November 10, 2026) is the newest fixed build named in N-able’s CVE records. N-able’s release notes say direct upgrades are supported from 2025.4 or later, and that hosted and on-premises customers must also upgrade agents and probes. Older servers need an intermediate upgrade first.

Does N-able have its own vulnerability disclosure program?

Yes. N-able has been a CVE Numbering Authority since at least Jul 1, 2024, when it published CVE-2024-28200, and it has filed 26 of the 44 CVEs in this dataset itself. The other 18 were assigned by MITRE or Google, mostly for flaws found by outside researchers before N-able became a CNA.

Does N-sight or Cove have vulnerabilities?

Very few on record. NVD lists 2 CVEs for the Advanced Monitoring Agent that N-sight RMM uses, both from 2020 under the SolarWinds MSP name, and none since. We found no CVE for Cove Data Protection under that name or its earlier SolarWinds Backup branding. The Ecosystem Agent shared by N-central and N-sight had one low-severity CVE, CVE-2024-5445.

Free to cite and republish with a link.

Methodology

References

1. NIST NVD API 2.0, CVEs assigned by the N-able CNA and keyword and CPE queries. Accessed November 2026.
2. CVE Program, CVE Services records for each of the 44 CVEs. Accessed November 2026.
3. CISA, Known Exploited Vulnerabilities Catalog, version 2026.11.10. Accessed November 2026.
4. N-able, N-central 2026.4 HF2 release notes (build 2026.4.1.26), November 10, 2026. Accessed November 2026.
5. N-able, N-central 2026.3 Hotfix 4 (2026.3.1.14), September 6, 2026; 2026.3 HF3 release notes (2026.3.1.13). Accessed November 2026.
6. N-able, N-central 2026.3 Hotfix 1 (2026.3.1.7), August 2, 2026; Hotfix 2 (2026.3.1.10), August 6, 2026. Accessed November 2026.
7. N-able, N-central security update, August 4, 2026. Accessed November 2026.
8. N-able, Announcing the GA of N-central 2025.3.1, August 13, 2025. Accessed November 2026.
9. Huntress, Critical N-able N-central Vulnerability and Active Exploitation; Huntress, N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains. Accessed November 2026.
10. Sophos, N-able N-central exploitation results in RMM tool deployment. Accessed November 2026.
11. N-able, N-sight RMM troubleshooting: Advanced Monitoring Agent will not sync or run checks. Accessed November 2026.
12. N-able, Terms of Use. Accessed November 2026.