N-able issues emergency hotfix for critical N-central RCE vulnerability

N-able N-central CVE-2026-86218 remote code execution supply chain risk

N-able has released an emergency hotfix (build 2026. 3. 1. 14) to address a maximum-severity remote code execution (RCE) vulnerability, tracked as CVE-2026-86218, in its N-central remote monitoring and management platform. The flaw, which carries a CVSS score of 10.0, allows unauthenticated attackers to execute arbitrary code via static code injection.

There are conflicting reports regarding active exploitation. N-able’s incident notice states the vulnerability has been observed being exploited in the wild, whereas its official release notes state there is no confirmation of exploitation in production environments. Cybersecurity firm Huntress has flagged the flaw as a potential zero-day and has observed exploitation attempts across multiple vulnerability waves affecting the platform.

This latest issue follows a series of critical vulnerabilities in N-central, including an authentication bypass chain (CVE-2026-86206 and CVE-2026-86207) disclosed on September 5. Because N-central is widely used by Managed Service Providers (MSPs), the vulnerability poses a significant supply chain risk, potentially allowing attackers to pivot from a single compromised instance to numerous downstream client networks.

N-able has already patched all hosted N-central instances. However, on-premises customers are urged to upgrade to the latest hotfix immediately to mitigate the risk. The Shadowserver Foundation is currently tracking approximately 1,500 exposed N-central servers online.

Entities

Cloudflare · Huntress · N-able · N-central · Shadowserver Foundation

Claims

What the coverage asserts, and how many sources carry each claim.

[● 4 SOURCES] N-able released Hotfix 4 (build 2026. 3. 1. 14) to address the remote code execution flaw. www.csoonline.com · thehackernews.com · www.ad-hoc-news.de
[● 2 SOURCES] Hosted N-central instances have already been patched by N-able. www.csoonline.com · thehackernews.com
[● 2 SOURCES] N-able's release notes state there is no confirmation of the vulnerability being exploited in production environments. thehackernews.com
[○ 1 SOURCE] N-able has found evidence of active exploitation of CVE-2026-86218. www.csoonline.com
[● 3 SOURCES] CVE-2026-86218 has been assigned a CVSS score of 10.0. thehackernews.com · forkast.news · www.ad-hoc-news.de
[○ 1 SOURCE] Huntress identified an exploit chain using CVE-2026-86206 and CVE-2026-86207 to bypass access controls. www.csoonline.com
[● 2 SOURCES] The new vulnerability, CVE-2026-86218, is unrelated to the two flaws disclosed on September 5. www.csoonline.com · thehackernews.com
[● 2 SOURCES] The Shadowserver Foundation is tracking approximately 1,500 exposed N-central servers. www.ad-hoc-news.de

Sources

Ceturtais ārkārtas ielāps piecās nedēļās: CVSS 10. 0 kļūda N-central ļauj izpildīt kodu bez pieteikšanās – itn — tehnoloģijas bez filtra [itn.lv]

3 days ago

N-able patches critical N-central RCE flaw amid exploit concerns [www.scworld.com]

3 days ago

Back-to-back N-able bugs send admins on a patching spree [www.csoonline.com]

5 days ago

N-able issues patch for zero-day flaw [cybernoz.com]

3 days ago

N-able N-central: Critical Pre-Authentication RCE CVE-2026-86218 [flagthis.com]

4 days ago

N-able N-central CVSS 10. 0 Pre-Auth RCE Marks Third Attack Wave in Six Weeks [forkast.news]

5 days ago

N-central: Kritische Lücke (CVSS 10. 0) ermöglicht Code-Ausführung [www.ad-hoc-news.de]

4 days ago

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw [thehackernews.com]

5 days ago