CVE-2026-86218: listed in the CISA KEV catalog

CVE-2026-86218 · EPSS 1% · KEV 2026-09-08 · patch available

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

Is CVE-2026-86218 exploited?

• Listed in the CISA KEV catalog on 2026-09-08.
• Federal remediation due 2026-09-11.
• EPSS puts exploitation in the next 30 days at 1%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• N-able · N-Central · <2026.3 Hotfix 3
• N-able · N-Central · <2026.3 Hotfix 4
• N-able · N-central · >= 0, < 2026.3.1.14

Is there a patch?

• N-Central 2026.3 Hotfix 3
• N-Central 2026.3 Hotfix 4

What PlainSec published about CVE-2026-86218

• N-central Exploit Puts Managed Access on the Line (2026-09-09)
• Microsoft’s Record Patch Tuesday Raises the Triage Bar (2026-09-09)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No CVSS score from NVD.

KEV and EPSS are re-checked daily. Record last updated 2026-09-09.