<?xml version="1.0" encoding="UTF-8"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Patchfirst: N-able vulnerabilities</title><link>https://patchfirst.co/vendor/n-able/</link><atom:link href="https://patchfirst.co/feed/vendor/n-able.xml" rel="self" type="application/rss+xml"/><description>New and newly exploited N-able CVEs, with CISA KEV, EPSS and ATT&amp;CK context. Newest 50 by publication or KEV listing.</description><language>en-gb</language><ttl>360</ttl><lastBuildDate>Sat, 31 Oct 2026 05:11:25 GMT</lastBuildDate><item><title>[KEV] CVE-2026-86218: N-able N-central Static Code Injection Vulnerability</title><link>https://patchfirst.co/cve/CVE-2026-86218/</link><guid isPermaLink="false">CVE-2026-86218#kev</guid><pubDate>Tue, 08 Sep 2026 00:00:00 GMT</pubDate><description>N-able · N-central. In CISA KEV since 2026-09-08. ENISA EUVD lists it as exploited. EPSS 15.4% (higher than 96.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&amp;CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.2 of 100.</description><category>kev</category><category>public-exploit</category><category>T1190</category><category>T1059</category></item><item><title>CVE-2026-86207: Authentication bypass leads to unauthorised access to N-central</title><link>https://patchfirst.co/cve/CVE-2026-86207/</link><guid isPermaLink="false">CVE-2026-86207</guid><pubDate>Sat, 05 Sep 2026 00:00:00 GMT</pubDate><description>N-able · N-central. Not in CISA KEV. EPSS 1.3% (higher than 69.4% of CVEs). CVSS 7.7 HIGH. Public exploit code exists. Priority 71.3 of 100.</description><category>public-exploit</category></item><item><title>CVE-2026-86206: Access control filter bypass allows unauthorised access to APIs</title><link>https://patchfirst.co/cve/CVE-2026-86206/</link><guid isPermaLink="false">CVE-2026-86206</guid><pubDate>Sat, 05 Sep 2026 00:00:00 GMT</pubDate><description>N-able · N-central. Not in CISA KEV. EPSS 1.1% (higher than 66.1% of CVEs). CVSS 6.9 MEDIUM. Public exploit code exists. Priority 70.1 of 100.</description><category>public-exploit</category></item><item><title>[KEV] CVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability</title><link>https://patchfirst.co/cve/CVE-2026-18556/</link><guid isPermaLink="false">CVE-2026-18556#kev</guid><pubDate>Tue, 04 Aug 2026 00:00:00 GMT</pubDate><description>N-able · N-central. In CISA KEV since 2026-08-04. ENISA EUVD lists it as exploited. EPSS 7.9% (higher than 94.7% of CVEs). CVSS 7.4 HIGH. Public exploit code exists. ATT&amp;CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Named in 5 threat reports. Priority 82.1 of 100.</description><category>kev</category><category>public-exploit</category><category>T1190</category><category>T1078</category></item><item><title>[KEV] CVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability</title><link>https://patchfirst.co/cve/CVE-2026-18577/</link><guid isPermaLink="false">CVE-2026-18577#kev</guid><pubDate>Mon, 03 Aug 2026 00:00:00 GMT</pubDate><description>N-able · N-central. In CISA KEV since 2026-08-03. ENISA EUVD lists it as exploited. EPSS 14.6% (higher than 96.7% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&amp;CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Named in 7 threat reports. Priority 88.0 of 100.</description><category>kev</category><category>public-exploit</category><category>T1190</category><category>T1078</category></item><item><title>CVE-2025-9316: N-central unauthenticated sessionID generation</title><link>https://patchfirst.co/cve/CVE-2025-9316/</link><guid isPermaLink="false">CVE-2025-9316</guid><pubDate>Wed, 12 Nov 2025 00:00:00 GMT</pubDate><description>N-able · N-central. Not in CISA KEV. EPSS 37.4% (higher than 98.5% of CVEs). CVSS 6.9 MEDIUM. Public exploit code exists. Named in 1 threat report. Priority 74.8 of 100.</description><category>public-exploit</category></item><item><title>CVE-2025-11700: N-central Multiple XXE Injection Vulnerabilities</title><link>https://patchfirst.co/cve/CVE-2025-11700/</link><guid isPermaLink="false">CVE-2025-11700</guid><pubDate>Wed, 12 Nov 2025 00:00:00 GMT</pubDate><description>N-able · N-central. Not in CISA KEV. EPSS 31.7% (higher than 98.3% of CVEs). CVSS 8.4 HIGH. Public exploit code exists. Priority 70.5 of 100.</description><category>public-exploit</category></item><item><title>CVE-2025-8875: N-able N-Central Insecure Deserialization Vulnerability</title><link>https://patchfirst.co/cve/CVE-2025-8875/</link><guid isPermaLink="false">CVE-2025-8875</guid><pubDate>Thu, 14 Aug 2025 00:00:00 GMT</pubDate><description>N-able · N-Central. In CISA KEV since 2025-08-13. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.8% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&amp;CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 65.4 of 100.</description><category>kev</category><category>public-exploit</category><category>T1078</category><category>T1059</category></item><item><title>CVE-2025-8876: N-able N-Central Command Injection Vulnerability</title><link>https://patchfirst.co/cve/CVE-2025-8876/</link><guid isPermaLink="false">CVE-2025-8876</guid><pubDate>Thu, 14 Aug 2025 00:00:00 GMT</pubDate><description>N-able · N-Central. In CISA KEV since 2025-08-13. ENISA EUVD lists it as exploited. EPSS 4.1% (higher than 90.8% of CVEs). CVSS 8.8 HIGH. ATT&amp;CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 62.3 of 100.</description><category>kev</category><category>T1190</category><category>T1059</category></item><item><title>CVE-2024-28200: N-central Authentication Bypass</title><link>https://patchfirst.co/cve/CVE-2024-28200/</link><guid isPermaLink="false">CVE-2024-28200</guid><pubDate>Mon, 01 Jul 2024 00:00:00 GMT</pubDate><description>N-able · N-central. Not in CISA KEV. EPSS 1.9% (higher than 80.2% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. Priority 62.4 of 100.</description><category>public-exploit</category></item></channel></rss>