Vendor scorecard
CISA lists 5 N-able vulnerabilities as exploited in the wild, 3 of them added in the last 12 months (up from 2 in the 12 months before). 0 (0%) are known to be used in ransomware campaigns. For entries added in the last two years, the median time from CVE publication to the KEV listing was 2 days. Most affected: N-central (3), N-Central (2).
| Product | KEV entries |
|---|---|
| N-central | 3 |
| N-Central | 2 |
| CVE | Vulnerability | Added |
|---|---|---|
| CVE-2026-86218 | N-able N-central Static Code Injection VulnerabilityN-central | |
| CVE-2026-18556 | N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityN-central | |
| CVE-2026-18577 | N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityN-central | |
| CVE-2025-8876 | N-able N-Central Command Injection VulnerabilityN-Central | |
| CVE-2025-8875 | N-able N-Central Insecure Deserialization VulnerabilityN-Central |
Get an email when CISA adds the next N-able CVE.
How to read this: CISA KEV lists vulnerabilities with reliable evidence of exploitation; a vendor with many entries is often one with a large, internet-facing install base, not necessarily worse engineering. "Publication → KEV" is the median number of days between the CVE's publication and its addition to KEV, for entries added in the last 24 months (3 entries); it is an upper bound on how long defenders had, since exploitation usually starts before the listing. Under NIS2 article 21(2)(d), supplier security is part of your risk management; this page is a starting point for that review. Compare vendors on the scorecard index.
We assess supplier security for NIS2 and DORA, from exploited-CVE history and patch response to contract clauses and evidence packs.
Get in touch →