N-able Releases Fourth N-central Hotfix for Critical Pre-Auth RCE Flaw
Summary
N-able’s Hotfix 4 fixes CVE-2026-86218 in on-premises N-central builds before 2026.3.1.14. The company’s notices conflict on in-the-wild exploitation; hosted instances are patched, and on-premises users are urged to update.
Key points
- CVE-2026-86218 is a CVSS 4.0 10.0-rated pre-authentication remote code execution flaw affecting N-central builds before 2026.3.1.14.
- N-able released Hotfix 4 on September 6; systems updated to Hotfix 3 are also affected and need the new update.
- N-able says hosted N-central instances are patched; on-premises customers should upgrade immediately. Agents do not need upgrading for this CVE.
- N-able’s incident notice says exploitation has been observed in the wild, while its release notes and status post say there are no confirmed production exploitations. The company has not identified who observed it or when.
- Huntress recommends restricting console access with IP allowlisting or a VPN and considering taking internet-reachable servers offline until patched.
- Huntress could not determine whether CVE-2026-86218 was used in a separate customer intrusion because relevant logs had rotated.
Article Details
- Vulnerability Types
- Static code injection
- Authentication bypass
- Unauthorized access to internal APIs
- Severity
- CVSS 4.0 score of 10.0 (maximum severity), assigned by N-able
- Affected Versions
- N-central on-premises builds earlier than 2026.3.1.14
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict inbound access to the N-central console using IP allowlisting or a VPN.
- Consider taking an internet-reachable server offline until the hotfix is applied.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationN-able says CVE-2026-86218 is a pre-authentication remote code execution flaw affecting on-premises N-central builds; its incident notice says exploitation was observed in the wild, while other company communications say exploitation is unconfirmed.T1219 · Remote Access ToolsIn the earlier intrusion described, attackers used N-central's Take Control feature to reach managed endpoints.
CVE
CVE-2025-8875a row that N-central has drawn in-the-wild attacks: in August 2025, two other flaws in the product, CVE-2025-8875 and CVE-2025-8876, were added to CISA’s catalog the same day N-able released fixes for them.CVE-2025-8876has drawn in-the-wild attacks: in August 2025, two other flaws in the product, CVE-2025-8875 and CVE-2025-8876, were added to CISA’s catalog the same day N-able released fixes for them.CVE-2026-18556Hotfix 1 (2026.3.1.7), August 2 — CVE-2026-18577, an incomplete fix for CVE-2026-18556 that still allowed authentication bypass and account takeover; exploited in the wildCVE-2026-18577Hotfix 1 (2026.3.1.7), August 2 — CVE-2026-18577, an incomplete fix for CVE-2026-18556 that still allowed authentication bypass and account takeover; exploited in the wildCVE-2026-86206Hotfix 3 (2026.3.1.13), September 5 — CVE-2026-86206, unauthorized access to internal APIs through the access control filter, and CVE-2026-86207, an authentication bypass in internal-only APIsCVE-2026-86207Hotfix 3 (2026.3.1.13), September 5 — CVE-2026-86206, unauthorized access to internal APIs through the access control filter, and CVE-2026-86207, an authentication bypass in internal-only APIsCVE-2026-86218N-able has issued Hotfix 4 for N-central to patch CVE-2026-86218, a maximum-severity pre-authentication remote code execution flaw affecting all on-premises builds before 2026.3.1.14.
Vendors
Products
N-centralN-able has issued Hotfix 4 for N-central to patch CVE-2026-86218, a maximum-severity pre-authentication remote code execution flaw affecting all on-premises builds before 2026.3.1.14.Take Controlauthentication bypass to obtain administrative access to N-central servers, then used the platform’s Take Control feature to reach managed endpoints and register Cloudflare tunnel services on those devices,