CVE-2023-37244: N-able Automation Manager

High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days.

The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp, which could be leveraged by an attacker to manipulate the process into performing arbitrary file deletions. We recommend upgrading to version 2.91.0.0

Affected products

• N-able Automation Manager: before 2.91.0.0 (fixed in 2.91.0.0)

Published 2024-05-02. Last modified 2026-06-17.