CVE-2026-86218
Known exploited · CISA KEV
EPSS 15% (97th percentile).
CISA federal remediation date Sep 11
Vulnerabilities · 49 days ago
N-able issued Hotfix 4 for N-central on September 6 to fix CVE-2026-86218, a pre-authentication remote code execution flaw in on-premises builds before 2026.3.1.14. That new build also supersedes Hotfix 3, so systems patched hours earlier still need this one.
The bug lets crafted input reach code paths the server treats as trusted, so an unauthenticated attacker can run code on the N-central box itself. N-able’s public notes say it has no production confirmation, while its customer notice and the Dutch NCSC both say exploit attempts were observed, which is why the advisory treats this as an immediate patching problem.
For MSP operators, the exposure is the management plane: a compromised N-central console can become a pivot into multiple customer environments, not just one server. On-premises instances carry that risk until they are on 2026.3.1.14; hosted NCOD customers were already patched, but the reporting still leaves the exploitation timeline contested.
Known exploited · CISA KEV
EPSS 15% (97th percentile).
CISA federal remediation date Sep 11
9 sources covering this story
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
CISA added actively exploited N-able N-central CVE-2026-86218 to KEV, with federal agencies ordered to patch by September 11.
N-able issues patch for zero-day flaw
Security researchers warned the company of unusual threat activity in a recently patched N-able environment.
Ve CVE-2026-86206 CVE-2026-86207 N Able N Central Authentication Bypass Fixed
While conducting research into a recent N-able N-central authentication bypass vulnerability (CVE-2026-18577), Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central.
N-able Patches Critical Zero-Day in N-central
Administrators are advised to check their deployments for newly created user accounts they don’t recognize.
Inyección de código estático en N-central de N-able
N-able ha publicado 1 vulnerabilidad de severidad crítica que, en caso de ser explotada, podría permit
N-able Releases Hotfix for Critical Remote Code Execution Flaw
The vulnerability, CVE-2026-86218, was allocated a maximum-severity rating by the software provider itself
N-able released an emergency hotfix for CVE-2026-86218, a remote code execution (RCE) flaw affecting N-central.
Kwetsbaarheid verholpen in N-central van N-able Revisies
N-able heeft een kwetsbaarheid verholpen in N-central versies eerder dan 2026.3.1.14.
N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
N-able patches a critical N-central flaw that could allow unauthenticated remote code execution, but its exploitation statements conflict.
N-able patches max severity N-central flaw amid ongoing attacks
N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform.
Part of the PlainSec briefing for 2026-09-07