CVE-2026-86218
Known exploited · CISA KEV
EPSS 15% (97th percentile).
CISA federal remediation date Sep 11
Vulnerabilities & Exploits
N-able issued Hotfix 4 for N-central on September 6 to fix CVE-2026-86218, a pre-authentication remote code execution flaw in on-premises builds before 2026.3.1.14. That new build also supersedes Hotfix 3, so systems patched hours earlier still need this one.
The bug lets crafted input reach code paths the server treats as trusted, so an unauthenticated attacker can run code on the N-central box itself. N-able’s public notes say it has no production confirmation, while its customer notice and the Dutch NCSC both say exploit attempts were observed, which is why the advisory treats this as an immediate patching problem.
For MSP operators, the exposure is the management plane: a compromised N-central console can become a pivot into multiple customer environments, not just one server. On-premises instances carry that risk until they are on 2026.3.1.14; hosted NCOD customers were already patched, but the reporting still leaves the exploitation timeline contested.
9 sources · Sep 9
Known exploited · CISA KEV
EPSS 15% (97th percentile).
CISA federal remediation date Sep 11
The Hacker News
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
CISA added actively exploited N-able N-central CVE-2026-86218 to KEV, with federal agencies ordered to patch by September 11.
originalCybersecurity Dive
N-able issues patch for zero-day flaw
Security researchers warned the company of unusual threat activity in a recently patched N-able environment.
originalRapid7
Ve CVE-2026-86206 CVE-2026-86207 N Able N Central Authentication Bypass Fixed
While conducting research into a recent N-able N-central authentication bypass vulnerability (CVE-2026-18577), Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central.
originalPart of the PlainSec briefing for 2026-09-07
Every edition of this story: N-central Hotfix 4 supersedes yesterday’s patch