N-able Issues N-central Hotfix 4 for Actively Exploited Pre-Auth RCE

Sep 6, 2026 · Original article ↗

Summary

N-able released Hotfix 4 for an actively exploited, critical pre-auth RCE in on-prem N-central. Huntress also reports separate authentication-bypass flaws and urges patching, restricted access, and checks for suspicious accounts and activity.

Key points

CVE-2026-86218 is a pre-auth remote-code-execution flaw rated CVSS 10.0; N-able says it has been exploited in the wild.
On-prem N-central users should upgrade to 2026.3 HF4; HF3 does not address the newly disclosed flaw. Hosted instances have already been patched.
Huntress reproduced a separate exploit chain involving CVE-2026-86206 and CVE-2026-86207 that could bypass access controls and create unauthorized administrative accounts.
Huntress observed a compromise at one customer organization but could not determine which specific vulnerability was used because appliance logs had rotated.
N-central compromise can give attackers administrative control of the RMM console and enable activity across managed endpoints.
Administrators should restrict console access, audit new accounts and permission changes, and investigate suspicious API requests, logins, and remote-control sessions.

Article Details

Vulnerability Types: Pre-authentication remote code execution
Authentication bypass
Account takeover
Severity: Critical; CVE-2026-86218 is rated CVSS 10.0.
Affected Versions: The August vulnerability was reported to affect all currently supported N-central versions, including 2026.3.
CVE-2026-18577 is described as affecting N-central versions through 2026.3.1.
Huntress reproduced the CVE-2026-86206/CVE-2026-86207 exploit chain against version 2026.3.1.10.
N-central 2026.3 HF3 remains vulnerable to CVE-2026-86218.
Exploitation Status: active
Exploit Availability: claimed_or_private
Patch Status: available
Workarounds: Restrict inbound access to the N-central console using strict IP allowlisting or a mandatory VPN.
If an exposed server cannot yet be patched, consider temporarily disabling N-central or taking it offline until the hotfix is applied.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`mousears[.]synology[.]me`	Listed by the article as a known malicious domain.
DOMAIN	`wagoosh[.]direct[.]quickconnect[.]to`	Listed by the article as a known malicious domain.
DOMAIN	`who-ripped-one[.]direct[.]quickconnect[.]to`	Listed by the article as a known malicious domain.
IPV4	`173[.]249[.]252[.]176`	Malicious IP address identified by N-able in its August 6 security update.
IPV4	`185[.]156[.]46[.]150`	Malicious IP address identified by N-able in its August 6 security update.
IPV4	`23[.]234[.]100[.]105`	Listed as an intruder IPv4 address associated with a Tzulo VPN.
IPV4	`23[.]234[.]94[.]43`	Malicious IP address identified by N-able in its August 6 security update.
IPV4	`23[.]234[.]97[.]68`	Listed as an intruder IPv4 address associated with a Tzulo VPN.
IPV4	`37[.]153[.]90[.]88`	Malicious IP address identified by N-able in its August 2 security update.
IPV4	`68[.]235[.]46[.]235`	Malicious IP address identified by N-able in its August 6 security update.
IPV4	`92[.]118[.]112[.]181`	Malicious IP address identified by N-able in its August 2 security update.