CVE-2026-86218: listed in the CISA KEV catalog

CVE-2026-86218 · EPSS 15% · KEV 2026-09-08 · patch available

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

Is CVE-2026-86218 exploited?

• Listed in the CISA KEV catalog on 2026-09-08.
• Federal remediation due 2026-09-11.
• Past that date by 48 days.
• EPSS puts exploitation in the next 30 days at 15%.
• Public exploit code: packaged in a public tool.
• Public detection rules exist.

Which products and versions are affected?

• N-able · N-central · >= 0, < 2026.3.1.14

Is there a patch?

Yes. Update to one of these or later:

From N-able's CVE record · N-able advisory

What PlainSec published about CVE-2026-86218

• N-central Hotfix 4 supersedes yesterday’s patch (2026-09-07)

Primary sources

• NVD record
• CISA KEV catalog
• N-able advisory
• Metasploit: exploit/linux/http/nable_ncentral_unauth_rce_cve_2026_86218
• Nuclei template

What this record does not say

• No CVSS score from NVD.

KEV and EPSS are re-checked daily. Record last updated 2026-10-25.