N-able known exploited vulnerabilities

CISA KEV catalog 2026.09.25 (1,726 CVEs) with FIRST EPSS scores from 2026-09-27.

CISA lists 5 N-able CVEs as exploited in the wild. 3 were added in the last 12 months (latest 2026-09-08), and 0 are known to be used in ransomware campaigns.

N-able CVEs added to CISA KEV per year

Year = when CISA added the CVE to the catalog (KEV started in November 2021).

Patch first: highest EPSS right now

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days.

CVE-2026-18577 (N-central): EPSS 14.6%, added 2026-08-03
CVE-2026-86218 (N-central): EPSS 12.9%, added 2026-09-08
CVE-2026-18556 (N-central): EPSS 7.9%, added 2026-08-04
CVE-2025-8876 (N-Central): EPSS 3.4%, added 2025-08-13
CVE-2025-8875 (N-Central): EPSS 1.9%, added 2025-08-13

Most affected N-able products

N-central (3), N-Central (2).

All N-able CVEs in KEV

CVE	Product	Flaw	Added	Federal due	EPSS	Ransomware
CVE-2026-86218	N-central	N-central Static Code Injection	2026-09-08	2026-09-11	12.9%	–
CVE-2026-18556	N-central	N-central Authentication Bypass Using an Alternate Path or Channel	2026-08-04	2026-08-07	7.9%	–
CVE-2026-18577	N-central	N-central Authentication Bypass Using an Alternate Path or Channel	2026-08-03	2026-08-06	14.6%	–
CVE-2025-8876	N-Central	N-Central Command Injection	2025-08-13	2025-08-20	3.4%	–
CVE-2025-8875	N-Central	N-Central Insecure Deserialization	2025-08-13	2025-08-20	1.9%	–

Federal due dates bind US federal civilian agencies (CISA binding operational directives); everyone else can use them as a priority hint. Sources: CISA KEV, FIRST EPSS.