Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
28 results
Sep 5, 2026N-able N-central Static Code Injection VulnerabilityCVE-2026-86218 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedCritical 10
N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.
- Product
- N-central
- On CISA’s list since
- Sep 8, 2026 (federal fix deadline Sep 11, 2026)
- What to do
- Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogme.n-able.comcisa.gov
Sep 5, 2026A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs.CVE-2026-86206 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bMedium 6.9
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.comme.n-able.com
Sep 5, 2026An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIsCVE-2026-86207 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bHigh 7.7
An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.comme.n-able.com
Aug 2, 2026N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-18577 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedHigh 8.2
N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.
- Product
- N-central
- On CISA’s list since
- Aug 3, 2026 (federal fix deadline Aug 6, 2026)
- What to do
- Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdocumentation.n-able.comstatus.n-able.com
Aug 1, 2026N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-18556 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedHigh 8.2
N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.
- Product
- N-central
- On CISA’s list since
- Aug 4, 2026 (federal fix deadline Aug 7, 2026)
- What to do
- Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloguptime.n-able.comcisa.gov
Nov 12, 2025N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.CVE-2025-9316 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bMedium 6.9
N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosureCVE-2025-11700 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bHigh 8.4
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserializationCVE-2025-11367 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bCritical 10
The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025N-central < 2025.4 is vulnerable to authentication bypass via path traversalCVE-2025-11366 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bCritical 9.4
N-central < 2025.4 is vulnerable to authentication bypass via path traversal
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to CVE-2025-10231 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bHigh 7
An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.comme.n-able.com
Aug 21, 2025On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server.CVE-2025-7051 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bHigh 8.3
On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.com
Aug 14, 2025N-able N-Central Command Injection VulnerabilityCVE-2025-8876 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedCritical 9.4
N-able N-Central contains a command injection vulnerability via improper sanitization of user input.
- Product
- N-Central
- On CISA’s list since
- Aug 13, 2025 (federal fix deadline Aug 20, 2025)
- What to do
- Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogstatus.n-able.comcisa.gov
Aug 14, 2025N-able N-Central Insecure Deserialization VulnerabilityCVE-2025-8875 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedCritical 9.4
N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.
- Product
- N-Central
- On CISA’s list since
- Aug 13, 2025 (federal fix deadline Aug 20, 2025)
- What to do
- Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogstatus.n-able.comcisa.gov
Mar 17, 2025N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory.CVE-2024-8510 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bMedium 5.3
N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerability is present in all deployments of N-central prior to N-central 2024.6.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.comme.n-able.com
Jul 1, 2024The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass.CVE-2024-5322 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bCritical 9.1
The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. This vulnerability is present in all Entra-supported deployments of N-central prior to 2024.3.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.comme.n-able.com
Jul 1, 2024The N-central server is vulnerable to an authentication bypass of the user interface.CVE-2024-28200 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bCritical 9.1
The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered through internal N-central source code review and N-able has not observed any exploitation in the wild.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.comme.n-able.com
Feb 8, 2024An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls.CVE-2023-47132 · Other software · N-able · reported by MITRECritical 9.8
An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.n-able.comme.n-able.com
Aug 3, 2023An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the serverCVE-2023-30297 · Other software · N-able · reported by MITREHigh 7
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatus.n-able.comn-able.com
Dec 16, 2020An issue was discovered in SolarWinds N-Central 12.3.0.670.CVE-2020-25622 · Other software · Solarwinds · reported by MITREHigh 8.8
An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020An issue was discovered in SolarWinds N-Central 12.3.0.670.CVE-2020-25621 · Other software · Solarwinds · reported by MITREHigh 8.4
An issue was discovered in SolarWinds N-Central 12.3.0.670. The local database does not require authentication: security is only based on ability to access a network interface. The database has keys and passwords.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020An issue was discovered in SolarWinds N-Central 12.3.0.670.CVE-2020-25620 · Other software · Solarwinds · reported by MITREHigh 7.8
An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user accounts named support@n-able.com and nableadmin@n-able.com. These allow logins to the N-Central Administrative Console (NAC) and/or the regular web interface.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020An issue was discovered in SolarWinds N-Central 12.3.0.670.CVE-2020-25619 · Other software · Solarwinds · reported by MITREMedium 4.4
An issue was discovered in SolarWinds N-Central 12.3.0.670. The SSH component does not restrict the Communication Channel to Intended Endpoints. An attacker can leverage an SSH feature (port forwarding with a temporary key pair) to access network services on the 127.0.0.1 interface, even though this feature was only intended for user-to-agent communication.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020An issue was discovered in SolarWinds N-Central 12.3.0.670.CVE-2020-25618 · Other software · Solarwinds · reported by MITREHigh 8.8
An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root (i.e., the use of root privileges is not limited to specific programs listed in the sudoers file).
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020An issue was discovered in SolarWinds N-Central 12.3.0.670.CVE-2020-25617 · Other software · Solarwinds · reported by MITREHigh 8.8
An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows Relative Path Traversal by an authenticated user of the N-Central Administration Console (NAC), leading to execution of OS commands as root.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2020SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly.CVE-2020-15910 · Other software · Solarwinds · reported by MITREMedium 4.7
SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlimenetworks.nlsolarwindsmsp.com
Oct 19, 2020SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access.CVE-2020-15909 · Other software · Solarwinds · reported by MITREHigh 8.8
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take advantage of this, cookie could be stolen and the JSESSIONID can be captured. On its own this is not a surprising result; low security tools allow the cookie to roam from machine to machine. The JSESSION cookie can then be used on the attackers’ workstation by browsing to the victim’s NCentral server URL and replacing the JSESSIONID attribute value by the captured value. Expected behavior would be to check this against a second source and enforce at least a reauthentication or multi factor request as N-Central is a highly privileged service.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlimenetworks.nlsolarwindsmsp.com
Jan 26, 2020SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe sCVE-2020-7984 · Other software · Solarwinds · reported by MITREHigh 7.5
SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the agent/appliance configuration.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.huntresslabs.comcommunity.solarwindsmsp.com
Jul 21, 2015The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installatCVE-2015-5610 · Other software · Solarwinds · reported by MITREMedium 4
The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it easier for remote authenticated users to obtain the cleartext domain-administrator password by locating the encrypted password within HTML source code and then leveraging knowledge of this key from another installation.
- Product
- N-able N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.