CISA Flags Actively Exploited N-able N-central RCE Flaw
Summary
CISA added CVE-2026-86218, a critical pre-authentication RCE flaw in N-able N-central, to its KEV catalog. N-able reports in-the-wild exploitation and released a hotfix; Huntress cannot confirm which flaw was used in a customer compromise.
Key points
- CISA added CVE-2026-86218, a static code injection flaw enabling pre-authentication remote code execution, to its KEV catalog.
- N-able patched the flaw in N-central 2026.3 Hotfix 4, released September 5, 2026.
- N-able said the vulnerability has been exploited in the wild and urged customers to apply the hotfix.
- CISA set September 11, 2026, as the remediation deadline for FCEB agencies.
- Huntress is investigating a compromise of a customer's fully patched N-central environment but could not determine which exploit was used.
- Two other N-central flaws, CVE-2026-86206 and CVE-2026-86207, were patched the same day; Rapid7 said they can be chained to bypass authentication and create an attacker-controlled administrator account.
Article Details
- Vulnerability Types
- Static code injection
- Pre-authentication remote code execution
- Severity
- Critical (CVSS 10.0)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1136 · Create AccountCVE-2026-86206 and CVE-2026-86207 can be chained to create a new attacker-controlled System Administrator account on an affected server.T1190 · Exploit Public-Facing ApplicationCVE-2026-86218 is a pre-authentication remote code execution vulnerability in N-central; N-able said it had been exploited in the wild.
CVE
CVE-2026-86206However, it remains unclear if the intrusion involved CVE-2026-86218 or two other vulnerabilities (CVE-2026-86206 and CVE-2026-86207) that were patched by N-able the same day with N-central 2026.3 Hotfix 3.CVE-2026-86207However, it remains unclear if the intrusion involved CVE-2026-86218 or two other vulnerabilities (CVE-2026-86206 and CVE-2026-86207) that were patched by N-able the same day with N-central 2026.3 Hotfix 3.CVE-2026-86218CISA has added CVE-2026-86218, a critical static code injection flaw in N-able N-central, to its KEV catalog and ordered FCEB agencies to patch it by September 11, 2026.
People
Vendors
HuntressN-able said the issue has been exploited in the wild, while Huntress is investigating a compromise of a fully patched N-central environment and cannot confirm which vulnerability was used.N-ableCISA has added CVE-2026-86218, a critical static code injection flaw in N-able N-central, to its KEV catalog and ordered FCEB agencies to patch it by September 11, 2026.