CSIRT Italia said N-able’s N-central flaw CVE-2026-86218 is being exploited in the wild, making the remote-management platform the immediate priority. N-able’s September fixes address three N-central vulnerabilities, while Ivanti also shipped patches the same day for Neurons for ITSM, Sentry, and Endpoint Manager Mobile.
CSIRT Italia says the N-central issue lets a remote attacker send crafted HTTP or HTTPS requests to an exposed server port, plant directives in files the server later trusts, and have those directives executed when the files are processed. In plain terms, the management console can be made to run attacker code, so the exposure is the control plane and everything it administers, not just the host running N-central.
That changes the reading for anyone running internet-facing management software: once the control layer is compromised, cleanup is not confined to a single box. Ivanti’s September fixes still matter, but this reporting puts N-able’s active incident ahead of scheduled patching for teams that manage fleets through these platforms.