N-able N-central Pre-Authentication Remote Code Execution (CVE-2026-86218)

The CVE record says N-central is vulnerable to a pre-authentication remote code execution flaw. N-able, the CVE numbering authority, rates it CVSS 4.0 10.0 Critical. The weakness is static code injection (CWE-96), and NVD lists CVSS 3.1 9.8 Critical.

N-central is N-able's remote monitoring and management platform, which N-able says managed service providers and IT teams use to keep their environments secure. The server sits at the centre of the endpoints it manages. Code that runs on it can reach every device the platform manages, which is why a flaw here matters more than one in a single endpoint tool.

What the Record Says an Attacker Needs

The CVSS vector in the CVE record is network, low complexity, no privileges and no user interaction. An unauthenticated attacker who can reach the N-central server over the network can attempt the attack. The record gives no technical detail beyond the one-line description.

N-able's status post of 6 September 2026 describes it as a critical vulnerability that could allow pre-authenticated remote code execution on the N-central server. The post says a third party reported it through N-able's security disclosure program. It names no workaround, only the hotfix.

What N-able and Huntress Say About Exploitation

N-able's status post says "we have no confirmations that this vulnerability has been exploited in production environments." That was the vendor's position on 6 September. CISA added the CVE to its Known Exploited Vulnerabilities catalog two days later, on 8 September 2026.

Huntress, a security vendor, tracks N-central attacks in a running research post that it last updated on 6 September. It reports attackers using the August 2026 N-central flaws, which N-able confirmed were exploited, to gain administrator access to vulnerable servers. It says they then used the built-in Take Control feature to reach endpoints and set up Cloudflare tunnels for persistence. Huntress does not tie that activity to CVE-2026-86218.

Huntress also describes a fully patched customer production server that it began investigating on 4 September. It says the server logs had rotated, so it cannot say whether CVE-2026-86218 was the flaw used in that case. Huntress adds that a community post and N-able's incident page say this flaw has been exploited in the wild, while N-able's status post says it had no confirmations.

Where This Flaw Sits in the N-central Run

The flaw is the latest in a series. CISA lists CVE-2026-18577, an authentication bypass, in KEV since 3 August 2026 and says it came from an incomplete patch for CVE-2026-18556. Huntress adds CVE-2026-86206 and CVE-2026-86207, which it tied to a proof of concept on 5 September.

Huntress says N-able shipped four hotfixes between early August and 6 September. Hotfix 4 supersedes Hotfix 3. Running an earlier hotfix therefore does not cover this CVE, and Huntress says servers on Hotfix 3 stay vulnerable.

Public Proof-of-Concept Claims and Dark Web Posts

We checked three public signals on 4 November 2026. The table lists what each one shows.

We read the three READMEs as data and ran no code. One repository describes itself as a proof of concept for a pre-authentication Struts flaw, with a version check and exploit steps. Another claims a Python exploit, and the third README is a donation page. The authors' claims are unverified, so we link none of them.

For context, see our entry on known exploited vulnerabilities and on remote code execution. An RMM server is a high-value target because it reaches every device it manages.

The CVE record lists N-central versions from 0 up to, but not including, 2026.3.1.14 as affected. N-able fixed it in N-central 2026.3 Hotfix 4, build 2026.3.1.14. NVD's configuration lists releases before 2026.3, plus 2026.3 and its Hotfix 1, 2 and 3 builds.

N-able's status post lists the supported direct upgrade paths to 2026.3.1.14 as 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1 and Hotfix 2. Customers on older versions should first move to one of those builds. The Hotfix 1 build number comes from Huntress, not from N-able's post.

N-able says self-hosted customers should upgrade to 2026.3 Hotfix 4 immediately. It says the hotfix needs no agent upgrade to address the CVE, though it recommends current agents as good practice. A separate download exists for accounts with the CMMC subscription.

The version facts above come from N-able's status post, the CVE record and NVD. Our patch management glossary entry covers how to track a rollout like this.