CVE-2026-15580: N-able Passportal

Medium severity, CVSS 6.9. EPSS: 0.2% chance of exploitation in the next 30 days.

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.

Affected products

• N-able Passportal: before 3.49.6 (fixed in 3.49.6)

Published 2026-08-21. Last modified 2026-09-08.