N-able patches actively exploited, maximum-severity N-central flaw
Summary
CISA added N-able N-central flaw CVE-2026-86218 to its Known Exploited Vulnerabilities catalog. N-able issued a hotfix for affected self-hosted deployments; hosted deployments received vendor-applied remediation.
Key points
- CVE-2026-86218 is a maximum-severity static code injection flaw that could enable pre-authentication remote code execution on N-central servers.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 9, 2026, citing active exploitation.
- The flaw affects N-central versions before 2026.3.1.14. N-able released Hotfix 4 on September 5; self-hosted deployments need to install it, while hosted deployments received vendor-applied remediation.
- Compromising an N-central server may expose administrative functions and managed endpoints; downstream impact depends on privileges, integrations, and managed systems.
- Researchers demonstrated that CVE-2026-86206 and CVE-2026-86207 could be chained to create a System Administrator account, but could not determine whether that chain or CVE-2026-86218 was involved in a reported compromise.
- N-able recommends reviewing logs for connections from 23.234.64.0/18 associated with observed scanning activity. The article also advises restricting management access and reviewing accounts, logs, and managed endpoints.
Article Details
- Vulnerability Types
- Static code injection
- Access control filter bypass
- Authentication bypass
- Severity
- Maximum severity; CVE-2026-86218 received a CVSS score of 10.0.
- Affected Versions
- N-central versions prior to 2026.3.1.14
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict management interfaces to dedicated administrative networks, VPNs, or approved source IP ranges.
MITRE ATT&CK
T1098 · Account ManipulationResearchers demonstrated that chaining CVE-2026-86206 and CVE-2026-86207 allowed an unauthenticated user to create a new System Administrator account.T1190 · Exploit Public-Facing ApplicationCVE-2026-86218 is described as enabling pre-authentication remote code execution on an N-central server.
CVE
CVE-2026-18577In addition to the two chain-able vulnerabilities referenced earlier, another vulnerability identified as CVE-2026-18577 was added to CISA's KEV catalog after confirmed exploitation.CVE-2026-86206CVE-2026-86206, an access control filter bypass that can expose internal N-central application programming interfaces (APIs) that are not intended to be externally accessible.CVE-2026-86207CVE-2026-86207, an authentication bypass affecting internal APIs that trust requests originating from within the application.CVE-2026-86218The flaw, tracked as CVE-2026-86218, is described by N-able and CISA as a static code injection vulnerability that could allow pre-authentication remote code execution on the N-central server.