Critical Vulnerability in N-able Passportal Extensions Exposed

A critical vulnerability in N-able Passportal’s browser extensions for Chrome and Microsoft Edge has been identified, allowing malicious websites or iframes to access an organization's password vault, including live two-factor authentication codes. This flaw, tracked as CVE-2026-15580, has a CVSS v4.0 base score of 9.4 and affects Passportal extension version 3.49.5. N-able has released an updated version, 3.49.6, to address this issue. Organizations using the affected version are at risk of credential theft and unauthorized access. The vulnerability was disclosed on August 21, 2026, and immediate action is required to mitigate potential exploitation.

Key Points: • CVE-2026-15580 has a CVSS score of 9.4, indicating critical severity. • The vulnerability affects N-able Passportal browser extensions for Chrome and Edge. • Organizations are urged to update to version 3.49.6 to mitigate risks.