CVE-2023-30297

The CVE-2023-30297 entry concerns N-able Technologies N-central Server prior to version 2023.4. The issue allows a local attacker to execute arbitrary code through the server’s monitoring function. The root cause is a vulnerability in the monitoring feature that enables code execution with low pr...

CVE-2023-47132

CVE-2023-47132 pertains to N-able N-central (pre-2023.6) where an API-call related flaw allows privilege escalation. Affected software: N-able N-central before 2023.6; impact is elevated privileges via API calls (no user interaction required). Mitigation: upgrade to version 2023.6 or later (per v...

CVE-2024-8510

CVE-2024-8510 affects N-able N-Central. The issue is a path traversal that can grant unintended access to the Apache Tomcat WEB-INF directory. The description notes that customer data is not exposed, and the vulnerability exists in all deployments prior to N-central 2024.6. Affected components ar...

CVE-2024-28200

The CVE-2024-28200 involves an authentication bypass in the N-central server user interface present in all deployments prior to version 2024.2. The N-central authentication bypass allows access to restricted UI areas without credentials. Connected sources confirm affected software: N-central prio...

CVE-2024-5322

The CVE-2024-5322 issue affects N-central prior to 2024.3 and enables session rebinding for already authenticated users when Entra SSO is used, potentially bypassing authentication. Reported across multiple feeds (NVD/Red Hat/PT-Security and others) with a high impact (C/H, I/H) and network attac...

CVE-2025-11367

The CVE-2025-11367 entry affects the N-central Software Probe (windows) prior to version 2025.4. The vulnerability relies on deserialization, allowing remote code execution with network access and no authentication. Impact is described as full compromise of affected systems (high confidentiality,...

CVE-2025-8875

CVE-2025-8875 – N-able N-central : A deserialization of untrusted data vulnerability in N-central allows local code execution on versions prior to 2025.3.1. Impact includes potential high confidentiality, integrity, and availability impacts per CVSS 3.1/4.0 vectors (LOCAL access, low privileges, ...

CVE-2025-8876

CVE-2025-8876 is an OS command injection vulnerability in N-able N-central caused by improper input validation, affecting versions before 2025.3.1. Public sources (CISA KEV, NCSC advisories) indicate active exploitation risk and note that updates fixing the issue were released (N-central GA 2025....

CVE-2025-7051

CVE-2025-7051 concerns N-able N-Central. Affected: N-Central deployments prior to 2025.2. Describe vulnerability: an authenticated user can read, write, and modify syslog configurations across customers on an N-Central server. This is an insecure direct object access-like issue enabling cross-ten...

CVE-2025-11366

Summary: CVE-2025-11366 affects N-able N-central, versions prior to 2025.4, with an authentication bypass via path traversal. The issue enables bypassing login controls by manipulating file paths, exposing high-privilege access. Impact: high confidentiality, integrity, and availability risks may ...

CVE-2025-11700

N-able N-Central is affected by CVE-2025-11700. Versions earlier than 2025.4 are vulnerable to an XML External Entity (XXE) injection, enabling information disclosure. Remediation: upgrade to version 2025.4 or later.

CVE-2025-10231

CVE-2025-10231 affects the N-able N-central Windows Agent and Probe. The issue is an incorrect file handling permission that, under certain conditions, could allow a local low-privilege user to execute commands with elevated permissions (privilege escalation). Public sources in the connected docu...