CVE-2026-86218

What is N-able N-central?

N-able N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) and IT departments to monitor, patch, and remotely control every endpoint across the networks they administer. An N-central server holds privileged agent credentials and the ability to run commands on all managed machines, so compromising the server itself is a supply-chain-style event: it multiplies into every downstream client network at once. RMM platforms like N-central, Kaseya VSA, and ConnectWise Automate have repeatedly been used to push ransomware to thousands of endpoints from a single breach.

Overview

CVE-2026-86218 is a CVSS 9.8 static code injection (CWE-96) in the N-central server that allows pre-authentication remote code execution. An unauthenticated remote attacker can inject and execute arbitrary code on the server without user interaction. N-able released N-central 2026.3 Hotfix 4 on 2026-09-06, its fourth N-central emergency hotfix in five weeks, and CISA added the CVE to KEV on 2026-09-08.

Affected Versions

N-able-hosted instances (NCOD) were patched by N-able and require no customer action. Self-hosted and on-premises deployments must be upgraded manually to Hotfix 4.

Technical Details

Static code injection (CWE-96) means attacker-supplied input is written into code that the application later evaluates, so the injected directive executes as part of the program. In N-central, the flaw is reachable before authentication, so an attacker does not need any credential or session to trigger it. The result is arbitrary code execution on the N-central server.

Attack characteristics:

• Authentication: none
• Complexity: low
• Vector: network, to the N-central web interface
• Impact: full server compromise (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

This hotfix followed closely on Hotfix 3, which addressed CVE-2026-86206 and CVE-2026-86207, underscoring a period of sustained scrutiny of N-central.

Discovery

The vulnerability was responsibly disclosed to N-able by a third party through its security disclosure program. The specific researcher was not named in N-able's advisory.

Exploitation Context

N-able's messaging was initially mixed: the public hotfix announcement said there was no confirmation of exploitation in production, while a separate direct notice to customers stated the flaw had been observed being exploited in the wild. CISA's addition to KEV on 2026-09-08 is consistent with active exploitation. Horizon3 published a NodeZero Rapid Response test on 2026-09-15 to let defenders validate exploitability safely, and other reporting referenced availability of a Metasploit module. No specific exposure count or threat-actor attribution had been published as of 2026-09-16.

Remediation

1. Upgrade self-hosted and on-premises N-central to 2026.3 Hotfix 4 (build 2026.3.1.14) immediately. NCOD/hosted customers require no action.
2. Restrict access to the N-central web interface to trusted administrator networks and VPN while you patch; the vulnerability is pre-authentication, so exposure is the whole risk.
3. Hunt for compromise on self-hosted servers exposed before the patch: review web and application logs for anomalous unauthenticated POST requests, look for unexpected processes or scheduled tasks on the server, and check for new administrator accounts.
4. Assume downstream reach if the server was compromised. Because N-central can run commands on managed endpoints, review recent scripts, automation policies, and agent tasks pushed to clients for anything unauthorized, and rotate agent and integration credentials.
5. Rotate server secrets if any indicator is found: the N-central database credentials, API tokens, and any stored integration credentials for PSA and backup tools.