# N-Central vulnerabilities > N-Central is made by N-Able. We track 9 published vulnerabilities in it, across 14 versions. 5 of them are on the list of flaws known to be exploited, the newest added on 8 September 2026. If you run N-Central, check your version against the exploited flaws below and patch those first. Canonical page: https://www.edgeprotect.io/product/n-able/n-central ## At a glance - **Made by:** [N-Able](https://www.edgeprotect.io/vendors/n-able) - **Published vulnerabilities:** 9 - **Known to be exploited:** 5 - **Versions tracked:** 14 - **Most recently added to the known-exploited list:** [CVE-2026-86218](https://www.edgeprotect.io/what-is/cve-2026-86218), 8 September 2026. We keep watching the list. ## Which versions of N-Central do the exploited flaws hit? Each exploited flaw lists the versions it affects, as published. "before 2026.3" means every version up to, but not including, 2026.3. - [CVE-2026-86218](https://www.edgeprotect.io/what-is/cve-2026-86218) (N-able N-central Static Code Injection Vulnerability): before 2026.3, 2026.3, 2026.3-hotfix1, 2026.3-hotfix2, 2026.3-hotfix3 - [CVE-2026-18556](https://www.edgeprotect.io/what-is/cve-2026-18556) (N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability): up to 2026.1 - [CVE-2026-18577](https://www.edgeprotect.io/what-is/cve-2026-18577) (N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability): before 2026.3, 2026.3 - [CVE-2025-8875](https://www.edgeprotect.io/what-is/cve-2025-8875) (N-able N-Central Insecure Deserialization Vulnerability): before 2025.3.1 - [CVE-2025-8876](https://www.edgeprotect.io/what-is/cve-2025-8876) (N-able N-Central Command Injection Vulnerability): before 2025.3.1 ## Which N-Central vulnerabilities are being exploited? 5 flaws are on the government list of vulnerabilities known to be exploited, newest first: - [CVE-2026-86218](https://www.edgeprotect.io/what-is/cve-2026-86218): N-able N-central Static Code Injection Vulnerability. Critical, CVSS 10.0, chance of use in 30 days 15%, known exploited since 8 September 2026. - [CVE-2026-18556](https://www.edgeprotect.io/what-is/cve-2026-18556): N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability. High, CVSS 8.2, chance of use in 30 days 44%, known exploited since 4 August 2026. - [CVE-2026-18577](https://www.edgeprotect.io/what-is/cve-2026-18577): N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability. High, CVSS 8.2, chance of use in 30 days 15%, known exploited since 3 August 2026. - [CVE-2025-8875](https://www.edgeprotect.io/what-is/cve-2025-8875): N-able N-Central Insecure Deserialization Vulnerability. Critical, CVSS 9.4, chance of use in 30 days 2.3%, known exploited since 13 August 2025. - [CVE-2025-8876](https://www.edgeprotect.io/what-is/cve-2025-8876): N-able N-Central Command Injection Vulnerability. Critical, CVSS 9.4, chance of use in 30 days 4.1%, known exploited since 13 August 2025. ## Which N-Central flaws are most likely to be used? Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days): - [CVE-2026-18556](https://www.edgeprotect.io/what-is/cve-2026-18556): 44%, High (CVSS 8.2), known exploited - [CVE-2025-11700](https://www.edgeprotect.io/what-is/cve-2025-11700): 32%, High (CVSS 8.4) - [CVE-2026-86218](https://www.edgeprotect.io/what-is/cve-2026-86218): 15%, Critical (CVSS 10.0), known exploited - [CVE-2026-18577](https://www.edgeprotect.io/what-is/cve-2026-18577): 15%, High (CVSS 8.2), known exploited - [CVE-2025-8876](https://www.edgeprotect.io/what-is/cve-2025-8876): 4.1%, Critical (CVSS 9.4), known exploited - [CVE-2025-8875](https://www.edgeprotect.io/what-is/cve-2025-8875): 2.3%, Critical (CVSS 9.4), known exploited - [CVE-2024-28200](https://www.edgeprotect.io/what-is/cve-2024-28200): 1.9%, Critical (CVSS 9.1) - [CVE-2025-11367](https://www.edgeprotect.io/what-is/cve-2025-11367): 0.6%, Critical (CVSS 10.0) - [CVE-2025-11366](https://www.edgeprotect.io/what-is/cve-2025-11366): 0.6%, Critical (CVSS 9.4) - [CVE-2023-47132](https://www.edgeprotect.io/what-is/cve-2023-47132): 0.6%, Critical (CVSS 9.8) ## Questions ### How many vulnerabilities does N-Central have? We track 9 published vulnerabilities listed under the name N-Central, across 14 versions. The most recent N-Central flaw added to the known-exploited list is CVE-2026-86218, on 8 September 2026. ### Which N-Central vulnerabilities are being exploited? 5 are on the list of flaws known to be exploited. The most recently added are CVE-2026-86218, CVE-2026-18556 and CVE-2026-18577. ### Which versions of N-Central do the exploited flaws affect? Each flaw names its own versions, usually as ranges. The newest, CVE-2026-86218, affects before 2026.3, 2026.3, 2026.3-hotfix1, 2026.3-hotfix2 and more. The versions for every exploited flaw are listed on this page. ### How do I get alerts for N-Central? Create a EdgeProtect account and track N-Central. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook. ## Running N-Central? EdgeProtect keeps checking for you: - **Tell us what you run.** Pick your software from a list, or let us work it out from your website. - **We match it to every flaw.** Over 400,000 published flaws, checked against your list. - **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it. - **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools. Start free (no card, nothing to install): https://www.edgeprotect.io/register Book a demo: https://www.edgeprotect.io/contact